CVE-2026-78591
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Path Traversal vulnerability in the Kibana Fleet feature can lead to unauthorized deletion of resources. A low-privileged user could cause a subsequent action by a higher-privileged user in the Fleet administration interface to act on an unintended target, resulting in deletion of resources including accounts with elevated privileges.
Risk Assessment
Risk of deleting accounts with elevated privileges, potentially leading to loss of system access or privilege escalation by an attacker.
Recommendation
Update Kibana to a patched version and restrict user permissions in the Fleet interface.
Other vulnerabilities in Kibana
See all- CVE-2017-8452High
Kibana versions prior to 5.2.1 configured for SSL client access do not clean up file descriptors after certain requests, leading to accumulation over time until the process crashes.
- CVE-2016-1000219High
Kibana versions before 4.5.4 and 4.1.11, when a custom output is configured for logging, may write cookies and authorization headers to log files. This information could be used to hijack sessions of other users using Kibana behind some form of authentication such as Shield.
- CVE-2019-7609CriticalActively exploited
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that attempts to execute JavaScript code, potentially leading to arbitrary command execution with the permissions of the Kibana process on the host system.
- CVE-2026-82302High
Incorrect Authorization in Kibana can lead to unauthorized configuration modification via exploiting incorrectly configured access control security levels.
- CVE-2026-82299Medium
Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).
- CVE-2026-82298Medium
Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).
- CVE-2026-78596Medium
Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana can lead to unauthorized modification of data via Privilege Abuse (CAPEC-122). An authenticated user holding Security read-level access in a single Kibana space could trigger Entity Analytics migration operations that perform privileged writes across all Kibana spaces, regardless of that user's actual access scope.
- CVE-2026-78595Medium
Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An authenticated user holding read-level Fleet agent privileges in one Kibana space could enumerate agent metadata and access diagnostic content belonging to agents enrolled in other Kibana spaces.
- CVE-2026-78593Medium
An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond the caller's authorized Elasticsearch permissions.
- CVE-2026-78583High
Incorrect Authorization in Kibana can lead to privilege escalation via input data manipulation. Elasticsearch cluster privilege declarations from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents.
Original NVD description (English source)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126). A low-privileged user could cause a subsequent action taken by a higher-privileged user in the Fleet administration interface to act on an unintended target, resulting in the deletion of resources including accounts with elevated privileges.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS