CVE-2026-78599: Stored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal Resources
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal (CAPEC-126). A low-privileged user holding Fleet write access could cause a subsequent administrative delete action to act on unintended internal resources. Exploitation requires an administrator to interact with the affected Fleet interface.
Affected Software
Event History
Frequently Asked Questions
Who can trigger this issue?
A low-privileged user with Fleet write access can supply the path traversal input. The issue is relevant where such users can influence Fleet content that an administrator may later delete.
Does exploitation require administrator involvement?
Yes. The malicious input takes effect when an administrator interacts with the affected Fleet interface and performs a delete action. The low-privileged user cannot complete the described deletion without that subsequent administrative action.
What is the likely impact if exploitation succeeds?
The administrative delete action can be redirected to unintended internal resources, causing unauthorized deletion. The provided severity vector indicates an availability impact, with no confidentiality or integrity impact specified.