PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-33463 Elastic CVE debrief

A logic error in Kibana's time-bounded access token validation allows expired tokens to remain usable, enabling unauthorized information disclosure. The vulnerability stems from improper expiration timestamp validation (CWE-672), where tokens are not properly invalidated after their intended validity window expires. An unauthenticated actor in possession of such a token can retrieve associated content beyond the expiration time. This is classified as MEDIUM severity (CVSS 5.3) with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability was disclosed by Elastic on May 28, 2026, with fixes available in versions 8.19.16 and 9.3.5.

Vendor
Elastic
Product
Kibana
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-29
Advisory published
2026-05-28
Advisory updated
2026-05-29

Who should care

Organizations running Kibana versions prior to 8.19.16 or 9.3.5 that rely on time-bounded access tokens for content access control. Security teams responsible for authentication and session management in Elastic Stack deployments. Compliance officers monitoring for proper access control enforcement and token lifecycle management.

Technical summary

The vulnerability exists in Kibana's validation logic for time-bounded access tokens. A logic error in expiration timestamp checking allows tokens to remain functional after their designated expiration time. This is an instance of CWE-672, where operations are performed on resources after their intended termination point. The flaw enables an attacker with possession of an expired token to continue accessing associated content without authentication. The attack requires network access but no privileges or user interaction, with low complexity. Impact is limited to confidentiality (low) with no integrity or availability effects.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Kibana to version 8.19.16 or 9.3.5 or later to obtain the fix for this token validation vulnerability
  • Review access token issuance practices and implement additional monitoring for token usage patterns that may indicate exploitation
  • Audit logs for any anomalous access using time-bounded tokens, particularly access occurring outside expected validity windows
  • Validate that any custom token handling implementations properly check expiration timestamps before granting access
  • Consider implementing additional token revocation mechanisms as defense-in-depth for sensitive deployments

Evidence notes

The vulnerability is categorized as CWE-672 (Operation on a Resource after Expiration or Termination). CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The official Elastic security advisory confirms affected versions and patch availability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-33463 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-33463

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-33463 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-33463

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.