VYPR
← All advisories
Medium severity5.3NVD Advisory· Published May 28, 2026· Updated Jun 17, 2026

CVE-2026-33463

CVE-2026-33463

Description

Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time-bounded access token to remain usable beyond its intended validity window, enabling an unauthenticated actor in possession of the token to retrieve the associated content after expiration.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

5
  • Elastic/Kibanainferred3 versions
    (expand)+ 2 more
    • (no CPE)
    • cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*range: >=8.0.0,<8.19.16
    • (no CPE)
  • osv-coords2 versions
    pkg:bitnami/elkpkg:bitnami/kibana
    >= 8.0.0, < 8.19.16+ 1 more
    • (no CPE)range: >= 8.0.0, < 8.19.16
    • (no CPE)range: >= 8.0.0, < 8.19.16

Patches

Vulnerability mechanics

References

1

News mentions

1