CVE-2026-72677

Received Received - Intake

Relative Path Traversal in Kibana Leading to Resource Deletion

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description

Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored as provided and is later incorporated into the request that Kibana issues when that configuration is removed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-72677

EUVD

EUVD-2026-58264

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	kibana	*
elastic	kibana	8.19.16
elastic	kibana	9.3.5
elastic	kibana	9.4.2
elastic	kibana	to 8.19.17 (exc)
elastic	kibana	to 9.3.6 (exc)
elastic	kibana	to 9.4.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-23	The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Attack-Flow Graph

Executive Summary

CVE-2026-72677 is a Relative Path Traversal vulnerability in Kibana Fleet that allows an attacker to delete Kibana resources by exploiting path traversal sequences in a user-supplied identifier for a Fleet Server host configuration. The identifier is stored and later used in requests when the configuration is removed, enabling unauthorized deletion.

Detection Guidance

To detect this vulnerability, check if your Kibana instance is running a vulnerable version (8.19.16 or earlier, 9.3.5 or earlier, 9.4.2 or earlier). Use commands like 'curl -X GET http://localhost:5601/api/status' to check the version. Inspect Fleet Server host configurations for suspicious relative path sequences in identifiers.

Impact Analysis

This vulnerability can lead to unauthorized deletion of Kibana resources, including users, potentially disrupting services and causing data loss. Attackers could exploit it to remove critical configurations or data, affecting system integrity and availability.

Mitigation Strategies

Upgrade Kibana to a patched version (8.19.17, 9.3.6, or 9.4.3) immediately. If upgrading is not possible, restrict access to Kibana and Fleet Server configurations to trusted users only. Monitor for unauthorized deletions of resources.

Hi! I’m here to help you understand CVE-2026-72677. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70