CVE-2026-33458

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33458
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33458.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-33458
Aliases
Downstream
Published
2026-04-08T16:47:58Z
Modified
2026-08-12T16:25:00Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
Server-Side Request Forgery (SSRF) in Kibana One Workflow Leading to Information Disclosure
Details

Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass host allowlist restrictions in the Workflows Execution Engine, potentially exposing sensitive internal endpoints and data.

Database specific 
{
    "cna_assigner": "elastic",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33458.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "9.3.0"
                },
                {
                    "last_affected": "9.3.2"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/elastic/elasticsearch

Affected ranges

Type
GIT
Repo
https://github.com/elastic/elasticsearch
Events
Introduced
17b451d8979a29e31935fe1eb901310350b30e62
Fixed
640408e2dfd2af9fbfe5079e1575f93d8909a5f5
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "9.3.0"
        },
        {
            "fixed": "9.3.3"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v9.*
v9.3.0
v9.3.1
v9.3.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33458.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "197552160985889901664419673985356516486",
            "length": 1584
        },
        "id": "CVE-2026-33458-51412cf0",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/640408e2dfd2af9fbfe5079e1575f93d8909a5f5",
        "target": {
            "file": "server/src/test/java/org/elasticsearch/index/mapper/vectors/DenseVectorFieldMapperTests.java",
            "function": "indexMapping"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "170568493866625987361505518312236776013",
                "293170206883044799006840083449498043238",
                "127965022065811097656658400917104721951",
                "268080160680196637226945849294657874221"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-33458-f0c66f7c",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/640408e2dfd2af9fbfe5079e1575f93d8909a5f5",
        "target": {
            "file": "server/src/test/java/org/elasticsearch/index/mapper/vectors/DenseVectorFieldMapperTests.java"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T16:25:00Z"

Git / github.com/elastic/kibana

Affected ranges

Type
GIT
Repo
https://github.com/elastic/kibana
Events
Introduced
30ab63cc0017fe2da7a84fb9b285dd762468802d
Fixed
bf7be757e102e9c064ff7161919d283963c7d93d
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "9.3.0"
        },
        {
            "fixed": "9.3.3"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v9.*
v9.3.0
v9.3.1
v9.3.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33458.json"