CVE-2021-22136: Elastic Kibana

Low severity, CVSS 3.5. EPSS: 0.3% chance of exploitation in the next 30 days.

In Kibana versions before 7.12.0 and 6.8.15 a flaw in the session timeout was discovered where the xpack.security.session.idleTimeout setting is not being respected. This was caused by background polling activities unintentionally extending authenticated users sessions, preventing a user session from timing out.

Affected products

• Elastic Kibana: before 6.8.15 (fixed in 6.8.15); from 7.0.0, before 7.12.0 (fixed in 7.12.0)

Published 2021-05-13. Last modified 2026-06-17.