CVE-2026-33458
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Kibana One Workflow has an SSRF vulnerability (CWE-918). An authenticated user with workflow creation and execution privileges can bypass host allowlist restrictions in the Workflows Execution Engine, potentially exposing sensitive internal endpoints and data.
Risk Assessment
An attacker can access internal systems and data, potentially leading to information disclosure or further attacks on the infrastructure.
Recommendation
Apply patches provided by the vendor and restrict workflow creation privileges to trusted users only.
Original NVD description (English source)
Server-Side Request Forgery (CWE-918) in Kibana One Workflow can lead to information disclosure. An authenticated user with workflow creation and execution privileges can bypass host allowlist restrictions in the Workflows Execution Engine, potentially exposing sensitive internal endpoints and data.