CVE-2026-78590: Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low-privileged user holding Fleet Settings write access could cause a subsequent administrative action to act on unintended internal resources, resulting in the deletion of privileged resources such as user accounts and other organizational assets. Exploitation requires an administrator to interact with the affected Fleet interface.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A low-privileged user must have write access to Fleet Settings. Exploitation also requires a subsequent interaction by an administrator with the affected Fleet interface.
Is this exploitable without administrator involvement?
No. The described attack depends on an administrator performing an action in the affected Fleet interface after the low-privileged user supplies the crafted path-traversal input.
What is the likely impact if exploitation succeeds?
The administrative action can be redirected to unintended internal resources, causing deletion of privileged resources. The advisory specifically identifies user accounts and other organizational assets as examples.