Skip to content
ElasticCVE-2026-78591

Elastic Kibana: path traversal

Medium6.3CVE-2026-78591 · Published Sep 2, 2026 · updated Sep 3, 2026

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126). A low-privileged user could cause a subsequent action taken by a higher-privileged user in the Fleet administration interface to act on an unintended target, resulting in the deletion of resources including accounts with elevated privileges.

Elastic advisory

Affected versions

PackageAffectedFixed in
Kibana
Product
>= 8.0.0, <= 8.19.16No fix yet
>= 9.0.0, <= 9.3.5No fix yet
>= 9.4.0, <= 9.4.2No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-22

More Elastic advisories

All Elastic
Advisory
Elastic Kibana: improper authorization
Medium4.3Sep 2
Elastic Kibana: path traversal
Medium6.5Sep 2
Elastic Eck Operator: incomplete cleanup
Low3.5Sep 2
Elastic Kibana: missing authorization
Medium5.5Sep 2
Elastic Maps Server: path traversal
Medium5.3Sep 2
Elastic Agent: insecure permissions
High7.8Sep 2

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.

Double opt-in. Unsubscribe any time.