CVE-2026-115294
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in the Kibana Fleet feature can lead to unauthorized resource deletion via Path Traversal. A low-privileged user with Fleet agent policies write access could cause a subsequent administrative action to act on unintended resources, such as Kibana spaces.
Risk Assessment
Organizational assets like Kibana spaces that the low-privileged user cannot delete directly may be deleted through an administrator's interaction with the Fleet interface.
Recommendation
Update Kibana to a patched version and restrict write access to Fleet agent policies.
Other vulnerabilities in Kibana
See all- CVE-2017-8452High
Kibana versions prior to 5.2.1 configured for SSL client access do not clean up file descriptors after certain requests, leading to accumulation over time until the process crashes.
- CVE-2016-1000219High
Kibana versions before 4.5.4 and 4.1.11, when a custom output is configured for logging, may write cookies and authorization headers to log files. This information could be used to hijack sessions of other users using Kibana behind some form of authentication such as Shield.
- CVE-2019-7609CriticalActively exploited
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that attempts to execute JavaScript code, potentially leading to arbitrary command execution with the permissions of the Kibana process on the host system.
- CVE-2026-115295Medium
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read access to connectors in one Kibana space can retrieve connector execution log information from other spaces that they are not authorized to access. The disclosed information includes connector names and identifiers, execution status, timestamps, error messages, and aggregated execution statistics.
- CVE-2026-115293Medium
Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of the credentials that Kibana uses to connect to Elasticsearch. When these credentials are embedded in the Elasticsearch host URLs in the Kibana configuration, an authenticated user with the privileges to onboard Observability data can obtain them. The user can then access Elasticsearch directly with the privileges of the Kibana service account, which are outside the privileges granted to that user.
- CVE-2026-115292Medium
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with Machine Learning read access in one Kibana space can read the audit and error messages of data frame analytics jobs that belong to other spaces that the user is not authorized to access. These messages can include job details such as destination index names, analyzed field names, and failure information.
- CVE-2026-102412Medium
Incorrect authorization in Kibana can lead to disclosure of sensitive information. An authenticated user with limited Fleet privileges could access credential material restricted to Fleet administrators. Exploitation may allow theft of cryptographic keys and impersonation of trusted Fleet infrastructure components.
- CVE-2026-102410Medium
Missing authorization in Kibana's Metrics Experience feature allows a user with only data-store-level read access to retrieve index-derived metric data through Kibana, despite lacking the corresponding Kibana feature privilege. A related API enforced authorization, but this internal API did not.
- CVE-2026-102406High
Kibana contains an authorization bypass vulnerability in the Fleet package installation process. A user with delegated Fleet package-management privileges can claim a data stream identifier already in use by another tenant, redirecting the victim's data to infrastructure controlled by the attacker.
- CVE-2026-94400Medium
Uncontrolled resource consumption (CWE-400) in Kibana can lead to denial of service via excessive allocation (CAPEC-130).
Original NVD description (English source)
Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in the Kibana Fleet feature can lead to unauthorized resource deletion via Path Traversal (CAPEC-126). A low-privileged user with Fleet agent policies write access could cause a subsequent administrative action to act on unintended resources. This can result in the deletion of resources such as Kibana spaces and other organizational assets that the low-privileged user cannot delete directly. Exploitation requires an administrator to interact with the affected Fleet interface.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS