CVE-2026-72677 PUBLISHED

Relative Path Traversal in Kibana Fleet Leading to Unauthorized Deletion of Users and Other Resources

Assigner: elastic
Reserved: 10.08.2026 Published: 13.08.2026 Updated: 13.08.2026

Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored as provided and is later incorporated into the request that Kibana issues when that configuration is removed.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
CVSS Score: 7.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	Low	Integrity Impact	High
User Interaction	Required	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Elastic
Product	Kibana
Versions	Default: unaffected affected from 8.0.0 to 8.19.16 (incl.) affected from 9.0.0 to 9.3.5 (incl.) affected from 9.4.0 to 9.4.2 (incl.)

References

https://discuss.elastic.co/t/kibana-8-19-17-9-3-6-9-4-3-security-update-esa-2026-94/389512

Problem Types

CWE-23 Relative Path Traversal CWE

Impacts

CAPEC-139 Relative Path Traversal