CVE-2026-33463
Last modified
CVE-2026-33463 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time-bounded access token to remain usable beyond its intended validity window, enabling an unauthenticated actor in possession of the token to retrieve the associated content after expiration.. EPSS estimates a 0.24% chance of exploitation in the next 30 days.
Description
Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time-bounded access token to remain usable beyond its intended validity window, enabling an unauthenticated actor in possession of the token to retrieve the associated content after expiration.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Elastic | Kibana | >= 8.0.0, < 8.19.16 |
| Elastic | Kibana | >= 9.0.0, < 9.3.5 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-33463?
How severe is CVE-2026-33463?
How do I fix CVE-2026-33463?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-33458Server-Side Request Forgery (CWE-918) in Kibana One Workflow…7.7
- CVE-2026-33459Uncontrolled Resource Consumption (CWE-400) in Kibana can le…6.5
- CVE-2026-3346IBM Langflow Desktop 1.6.0 through 1.8.4 Lanflow is vulnerab…6.4
- CVE-2026-33460Incorrect Authorization (CWE-863) in Kibana can lead to cros…4.3
- CVE-2026-33461Incorrect Authorization (CWE-863) in Kibana can lead to info…6.5
- CVE-2026-33462A path traversal vulnerability was identified in Kibana's da…7.3
- CVE-2026-33464Uncontrolled Resource Consumption (CWE-400) in Kibana can le…6.5
- CVE-2026-33465Allocation of Resources Without Limits or Throttling (CWE-77…6.5
- CVE-2026-33466Improper Limitation of a Pathname to a Restricted Directory …9.8
- CVE-2026-33467Improper Verification of Cryptographic Signature (CWE-347) i…5.9
- CVE-2026-33468Kysely is a type-safe TypeScript SQL query builder. Prior to…8.1
- CVE-2026-33469Frigate is a network video recorder (NVR) with realtime loca…6.5
Are you affected by CVE-2026-33463?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST