7.3highHigh
CVE-2026-78590
Elastic Kibana
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low-privileged user holding Fleet Settings write access could cause a subsequent administrative action to act on unintended internal resources, resulting in the deletion of privileged resources such as user accounts and other organizational assets. Exploitation requires an administrator to interact with the affected Fleet interface.
Exploitation status
- A vendor advisory or patch reference has been published.
What the metrics mean
- It is reachable over a network, without needing local access.
- For an attacker who can reach it, no special conditions are needed to exploit it.
- To exploit it, an ordinary user account is needed.
- Beyond that, someone has to be persuaded to take an action first.
Scoring
- CVSS
- 7.3 (v3.1)
- Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H- Weakness
- CWE-22
- Assigned by
- security@elastic.co
Dates
- Published
- 2026-09-02
- Last modified
- 2026-09-03
- Sources
- NVD
Affected products
- Elastic Kibana8.0.0 - 8.19.18, 9.0.0 - 9.3.6, 9.4.0 - 9.4.3
As listed in the NVD configuration data. Not a statement about your estate.