CVE-2026-78591: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Kibana Leading to Unauthorized Resource Deletion
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126). A low-privileged user could cause a subsequent action taken by a higher-privileged user in the Fleet administration interface to act on an unintended target, resulting in the deletion of resources including accounts with elevated privileges.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Exploitation requires a low-privileged user who can interact with the Kibana Fleet feature, followed by a higher-privileged user taking an action in the Fleet administration interface. The issue is therefore most relevant where untrusted or lower-privileged users and Fleet administrators share access to the same Kibana deployment.
What does an attacker need to do to exploit this issue?
The attacker needs low-privileged access and must induce a subsequent Fleet administrative action by a higher-privileged user. User interaction by that higher-privileged user is required, and the vulnerable action can be redirected to an unintended path traversal target.
What is the impact if exploitation succeeds?
An attacker can cause unauthorized deletion of resources. The affected resources may include accounts with elevated privileges, creating integrity impact and potentially disrupting access or administration.