CVE-2026-72677

HighCVSS 7.3

Published: 13/08/2026(UTC)Updated: 13/08/2026(UTC)Translated: 14/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

Kibana contains a Relative Path Traversal (CWE-23) vulnerability that can lead to unauthorized deletion of Kibana resources. Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored and later incorporated into the request when that configuration is removed.

Risk Assessment

An attacker could delete Kibana resources, potentially disrupting operations or causing data loss.

Recommendation

Apply security patches provided by Elastic for Kibana.

Original NVD description (English source)

Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored as provided and is later incorporated into the request that Kibana issues when that configuration is removed.