Cyber Resilience

CVE-2026-33463

Elastic Kibana 8.0.0 – 8.19.16

Published
28 May 2026
Modified
17 June 2026
Patch / advisory
View advisory
CVSS Score v3.1 5.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0024 15th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-33463 is a medium-severity Operation on a Resource after Expiration or Release (CWE-672) vulnerability in Elastic Kibana. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-12 (Session Termination) and AC-3 (Access Enforcement) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Operation on a Resource after Expiration or Termination (CWE-672) in Kibana can lead to unauthorized information disclosure. A logic error in how expiration timestamps were validated allowed a time-bounded access token to remain usable beyond its intended validity window, enabling…

more

an unauthenticated actor in possession of the token to retrieve the associated content after expiration.

CWE(s)
CWE-672

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Vuln in public-facing Kibana allows expired token use for unauthorized data access, directly enabling exploitation of the app.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-42398Same product: Elastic Kibana
CVE-2026-49093Same product: Elastic Kibana
CVE-2024-37288Same product: Elastic Kibana
CVE-2024-43707Same product: Elastic Kibana
CVE-2026-4498Same product: Elastic Kibana
CVE-2026-49091Same product: Elastic Kibana
CVE-2026-26938Same product: Elastic Kibana
CVE-2025-25015Same product: Elastic Kibana
CVE-2025-25014Same product: Elastic Kibana
CVE-2025-68387Same product: Elastic Kibana

Affected Assets

elastic
kibana
8.0.0 — 8.19.16 · 9.0.0 — 9.3.5

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • AC-12 Session Termination
  • IA-5 Authenticator Management
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 1 hardening rule · 1 OS baseline
Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Directly enforces access decisions that must include checking token expiration timestamps, preventing use of expired tokens as described in the CVE.

AC-12 Session Termination good match
prevent

Requires automatic termination of sessions or tokens once their validity period ends, directly blocking the post-expiration access flaw.

IA-5 Authenticator Management partial match
prevent

Mandates proper management of authenticators (including time-bounded tokens) with enforced expiration and revocation to avoid reuse after validity.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
prevents

Enforcing managed authorizations and revocations directly prevents post-release operations on credentials or entitlements.

PR.PS-06 mostly match
prevents

Secure development practices eliminate the root coding flaw that permits use-after-release.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing can detect use-after-release but does not prevent it at runtime.

A.8.10 Information deletion partial match
degrades

Enforces timely deletion of resources so they cannot be used after release.

A.8.28 Secure coding partial match
prevents

Secure-coding rules require checks that prevent operations on freed or expired objects.

A.8.32 Change management partial match
prevents

Change-management processes can introduce or remove resource-lifetime controls.

References