Vulnerability · Published May 28, 2026 · Assigned by elastic
CVE-2026-33463Operation on a Resource after Expiration or Termination in Kibana Leading to Unauthorized File Access
Medium 5.3
In plain English
A medium-severity security flaw in Kibana from Elastic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Official description
Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time-bounded access token to remain usable beyond its intended validity window, enabling an unauthenticated actor in possession of the token to retrieve the associated content after expiration.
Affected products (as reported)
Weakness: CWE-672 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N