7.3highHigh
CVE-2026-72677
Elastic Kibana
Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored as provided and is later incorporated into the request that Kibana issues when that configuration is removed.
Exploitation status
- A vendor advisory or patch reference has been published.
What the metrics mean
- It is reachable over a network, without needing local access.
- For an attacker who can reach it, no special conditions are needed to exploit it.
- To exploit it, an ordinary user account is needed.
- Beyond that, someone has to be persuaded to take an action first.
Scoring
- CVSS
- 7.3 (v3.1)
- Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H- Weakness
- CWE-23
- Assigned by
- security@elastic.co
Dates
- Published
- 2026-08-13
- Last modified
- 2026-09-02
- Sources
- NVD
Affected products
- Elastic Kibana8.0.0 - 8.19.17, 9.0.0 - 9.3.6, 9.4.0 - 9.4.3
As listed in the NVD configuration data. Not a statement about your estate.