CVE-2026-78590 Path traversal in Kibana
A low-privileged user can exploit path traversal in Kibana Fleet to delete privileged resources if an administrator interacts with the interface.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-78590?
CVE-2026-78590 is a high-severity path traversal vulnerability in Elastic Kibana, published on 2 Sep 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low-privileged user holding Fleet Settings write access could cause a subsequent administrative action to act on unintended internal resources, resulting in the deletion of privileged resources such as user accounts and other organizational assets. Exploitation requires an administrator to interact with the affected Fleet interface.
Weakness: CWE-22
Which versions are affected by CVE-2026-78590?
It affects 1 product.
Products include Elastic Kibana.
How do I fix CVE-2026-78590?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-78590 being exploited?
There is no known exploitation of CVE-2026-78590 in the wild and no public exploit code.
Other vulnerabilities in Elastic Kibana
Sources
Also known as GHSA-9qfh-3q42-hfgw, MINI-3p2r-w252-rc5m, MINI-7v3j-7mp9-2gm6, MINI-ccww-fr8m-vvqw, MINI-h99m-5g2c-wpx2, MINI-phfh-x44f-9xf6 and 2 more.