CVE-2026-78590 in Kibana
Summary
by MITRE • 09/02/2026
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low-privileged user holding Fleet Settings write access could cause a subsequent administrative action to act on unintended internal resources, resulting in the deletion of privileged resources such as user accounts and other organizational assets. Exploitation requires an administrator to interact with the affected Fleet interface.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified involves a critical flaw within the Kibana Fleet feature, specifically categorized under CWE-22 Improper Limitation of a Restricted Directory Pathname, commonly known as path traversal. This security defect allows for CAPEC-126 Attack Surface Expansion through improper input validation and sanitization mechanisms when handling file paths or resource identifiers. The core technical issue stems from the application's failure to adequately restrict user-supplied inputs that reference internal system resources, thereby enabling an attacker to manipulate these references beyond their intended scope. In this specific context, the flaw resides in how the Fleet management interface processes requests related to configuration and agent settings, failing to enforce strict boundary checks on directory or resource paths before executing administrative operations.
The operational impact of this vulnerability is severe due to its potential for privilege escalation through social engineering or session hijacking scenarios rather than direct exploitation by a low-privileged user alone. A low-privileged user with write access to Fleet Settings can craft malicious requests that exploit the path traversal weakness. However, successful exploitation requires an administrative action triggered by a privileged administrator who interacts with the affected interface while authenticated as such. This creates a chain of trust abuse where the lower-privilege actor sets up the trap and the higher-privilege actor inadvertently triggers it. Consequently, this can lead to the unauthorized deletion of critical organizational assets, including user accounts, agent configurations, and other sensitive data managed by the Fleet module.
From an ATT&CK perspective, this vulnerability aligns with techniques involving T1078 Valid Accounts for initial access or persistence if combined with credential theft, but more directly relates to TA0040 Impact through destructive actions like Data Destruction (T1485). The attacker leverages the administrative interface to execute commands that delete resources outside their authorized domain. This represents a significant risk to data integrity and availability within Elasticsearch deployments utilizing Kibana for fleet management. Organizations must recognize that even limited write permissions in complex enterprise software can serve as vectors for catastrophic system compromise if input validation is insufficient.
Mitigation strategies should focus on immediate patching of the affected Kibana version to ensure all known path traversal flaws are addressed by the vendor. In addition to updating, administrators should implement strict role-based access control (RBAC) policies that minimize write permissions in the Fleet module to only those users who absolutely require them. Input validation must be enforced at both the client and server sides, ensuring that any pathname or resource identifier is strictly validated against a whitelist of allowed paths. Furthermore, implementing multi-factor authentication for administrative interfaces can reduce the risk of an administrator being tricked into executing malicious commands crafted by lower-privileged actors. Regular security audits and penetration testing focusing on privilege escalation vectors are essential to identify similar weaknesses in other modules before they can be exploited in production environments.