CVE-2026-33458CWE-918

Server-Side Request Forgery (SSRF) in Kibana One Workflow Leading to Information Disclosure

Medium · published April 8, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
31.2
In the wild
Unconfirmed
What it is

Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass host allowlist restrictions in the Workflows Execution Engine, potentially exposing sensitive internal endpoints and data.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00384 · 31.2th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-04-08T16:47Z
EPSS history
Timeline
  • 08 APR 16:47Z
    Server-Side Request Forgery (SSRF) in Kibana One Workflow Leading to Information Disclosure
    cvelistv5