CVE-2026-72677 in Kibana
Summary
by MITRE • 08/13/2026
Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored as provided and is later incorporated into the request that Kibana issues when that configuration is removed.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability represents a classic relative path traversal flaw that undermines the security boundaries of the Kibana platform. The issue stems from inadequate input validation within the Fleet Server host configuration management functionality, where user-supplied identifiers are accepted without proper sanitization or rejection of traversal sequences. This weakness allows attackers to manipulate resource identifiers containing ../ or similar path traversal components that can be exploited to access and potentially delete resources outside the intended scope.
The technical execution of this vulnerability occurs through the improper handling of user-provided data in the Fleet Server host configuration process. When a user submits a configuration identifier containing relative traversal sequences, these sequences are stored verbatim without validation or sanitization. Later during the resource removal operation, Kibana incorporates this unvalidated identifier into outgoing requests, effectively allowing attackers to manipulate the target path of deletion operations. This pattern aligns with CWE-23's classification of relative path traversal vulnerabilities where insufficient input validation enables unauthorized access to resources outside the intended directory structure.
The operational impact of this vulnerability extends beyond simple privilege escalation to include potential data loss and service disruption within Kibana environments. Attackers could leverage this weakness to delete critical Fleet Server configurations, potentially compromising the entire fleet management infrastructure. The vulnerability affects organizations using Kibana's Fleet feature for managing endpoint security configurations, where unauthorized deletion of host configurations could lead to complete loss of visibility into endpoint activities. This risk is particularly concerning in security operations centers where Kibana serves as a central dashboard for monitoring and managing security policies across distributed environments.
The exploitation of this vulnerability follows patterns consistent with CAPEC-139's description of relative path traversal attacks, where attackers manipulate input fields to traverse directory structures beyond intended boundaries. From an ATT&CK perspective, this represents a privilege escalation vector that could enable adversaries to move laterally within security infrastructure by compromising configuration management systems. Organizations should implement immediate mitigations including strict input validation for all user-supplied identifiers, sanitization of traversal sequences, and enforcement of proper access controls around Fleet Server configurations. Additionally, regular auditing of configuration management processes and implementation of automated monitoring for suspicious deletion patterns would help detect potential exploitation attempts.
Security teams must also consider the broader implications of this vulnerability within their overall security architecture, particularly in environments where Kibana serves as a central hub for security operations. The vulnerability demonstrates the importance of input validation at multiple levels within application architectures, emphasizing that even seemingly benign configuration management functions can become attack vectors when proper sanitization controls are absent. Organizations should prioritize patching affected versions of Kibana while implementing additional defensive measures such as network segmentation around critical configuration management interfaces and enhanced logging of all deletion operations to support forensic analysis in case of compromise.