Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time-bounded access token to remain usable beyond its intended validity window, enabling an unauthenticated actor in possession of the token to retrieve the associated content after expiration.
References
| Link | Resource |
|---|---|
| https://discuss.elastic.co/t/8-19-16-9-3-5-security-update-esa-2026-33/386551 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
29 May 2026, 21:18
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://discuss.elastic.co/t/8-19-16-9-3-5-security-update-esa-2026-33/386551 - Vendor Advisory | |
| First Time |
Elastic
Elastic kibana |
|
| CPE | cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:* |
28 May 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-28 20:16
Updated : 2026-05-29 21:18
NVD link : CVE-2026-33463
Mitre link : CVE-2026-33463
CVE.ORG link : CVE-2026-33463
JSON object : View
Products Affected
elastic
- kibana
CWE
CWE-672
Operation on a Resource after Expiration or Release