Kibana CVE-2026-33463

The attacker must be in possession of a previously issued Kibana access token that has passed its intended expiration timestamp - this is the defining prerequisite. Exploitation is not possible without a valid (though expired) token, which gates the attack to actors who have obtained one through legitimate access, credential theft, phishing, or interception of shared links. CVSS PR:N confirms no authentication is required beyond presenting the token itself. The scope is limited to confidentiality (C:L) of the specific content the token was scoped to access - lateral movement or broader system access is not implied by this vulnerability. Exploitation is further limited to content that still exists in Kibana at the time the expired token is replayed; if the underlying content has been deleted or access revoked at the content level, exploitation fails. No specific non-default configuration is required - any Kibana deployment issuing time-bounded tokens is potentially affected.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) scores 5.3 Medium, reflecting low-complexity network exploitation requiring no authentication or user interaction but with only low confidentiality impact and no integrity or availability consequence. The critical limiting factor not captured by raw CVSS is the prerequisite that an attacker must already possess a previously issued, now-expired token - this substantially narrows the exploitable population to actors who have legitimately or illegitimately obtained such tokens. No EPSS score was provided in the source data, making probabilistic exploitation forecasting unavailable. This vulnerability is not listed in the CISA KEV catalog and no public POC code has been identified, consistent with a lower-urgency patch priority. Real-world risk is moderate rather than critical: the attack is technically easy (no complexity, no authentication beyond token possession) but operationally gated by token acquisition. Organizations sharing sensitive Kibana content via time-bounded links face the greatest exposure.

An attacker who previously received or intercepted a time-bounded Kibana access token - for example, a shared dashboard link sent via email - retains that token after its stated expiration. Because the server-side expiration check contains a logic error, the attacker submits the expired token to the Kibana API and successfully retrieves the content associated with the token, such as dashboard data or embedded visualizations. No public POC exists at time of analysis, but the low-complexity CVSS vector indicates exploitation requires no specialized tooling beyond a standard HTTP client.