CVE-2026-115294 in Kibana
Summary
by MITRE • 11/03/2026
Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in the Kibana Fleet feature can lead to unauthorized resource deletion via Path Traversal (CAPEC-126). A low-privileged user with Fleet agent policies write access could cause a subsequent administrative action to act on unintended resources. This can result in the deletion of resources such as Kibana spaces and other organizational assets that the low-privileged user cannot delete directly. Exploitation requires an administrator to interact with the affected Fleet interface.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified involves a critical flaw within the Kibana Fleet feature, specifically categorized under CWE-22 Improper Limitation of a Pathname to a Restricted Directory and associated with CAPEC-126 Path Traversal. This security defect arises from insufficient validation or sanitization of user-supplied input when constructing file paths or resource identifiers for administrative operations. In the context of Kibana Fleet, which manages agent policies and configurations across an Elastic Stack deployment, this flaw allows a low-privileged user who possesses write access to fleet agent policies to manipulate these inputs in a way that bypasses intended directory restrictions. The core technical issue lies in the application's failure to properly canonicalize or restrict paths before processing them for administrative actions, thereby enabling path traversal techniques where sequences such as dot-dot-slash are used to navigate outside the expected secure boundaries into sensitive areas of the system configuration or storage.
The operational impact of this vulnerability is severe due to its potential for privilege escalation through social engineering or compromised workflows rather than direct technical exploitation by an unauthenticated attacker. A low-privileged user, who normally lacks the permissions to delete critical organizational assets such as Kibana spaces, can craft a malicious agent policy configuration that exploits the path traversal flaw. When this malformed input is processed during a subsequent administrative action—such as when an administrator reviews, approves, or synchronizes fleet policies—the system inadvertently executes deletion commands on resources outside the intended scope. This effectively allows the low-privileged user to trigger unauthorized resource deletion by leveraging the higher privileges of the interacting administrator. The attack vector relies heavily on the interaction between the compromised lower-level input and a privileged administrative interface, making it an instance of indirect privilege escalation where the attacker influences a trusted process to perform actions beyond their authorized level.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK techniques related to Defense Evasion and Privilege Escalation, particularly those involving manipulation of system processes or configuration files to achieve unintended outcomes. The exploitation requires an administrator to interact with the affected Fleet interface, which introduces a human-in-the-loop element that can be mitigated through strict access controls and procedural safeguards. However, in environments where multiple users have varying levels of fleet management permissions, this risk is amplified as any user with write access could potentially target administrators who regularly manage these policies. The deletion of Kibana spaces and other organizational assets represents a significant loss of integrity and availability, disrupting operational workflows and potentially leading to data loss or configuration corruption that may be difficult to recover without backups.
To mitigate this vulnerability, immediate remediation should involve applying the official security patches provided by Elastic for the affected versions of Kibana. In addition to patching, organizations must enforce strict principle of least privilege within their Elasticsearch and Kibana deployments. This includes restricting write access to fleet agent policies only to users who absolutely require it, rather than granting broad permissions based on role assumptions. Implementing robust input validation at both the application layer and API gateway level is essential to ensure that all path-related inputs are sanitized against traversal sequences before being processed by administrative functions. Furthermore, adopting a zero-trust architecture for internal service communications can help limit the blast radius of such vulnerabilities. Regular auditing of fleet policy changes and monitoring for anomalous deletion activities in system logs will also aid in early detection and response to any attempted exploitation attempts.