PT-2026-31344

CVE-2026-33458

Published

2026-04-08

Updated

2026-09-04

Description by

CVSS 3.1

7.7

High

MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kibana versions (affected versions not specified)

Description Kibana One Workflow contains a Server-Side Request Forgery (CWE-918) issue that can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass host allowlist restrictions in the Workflows Execution Engine, potentially exposing sensitive internal endpoints and data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-918: Server-Side Request Forgery (SSRF)

Related identifiers

CVE-2026-33458

BDU:2026-15209