CVE-2026-78591 Path traversal in Kibana
A low-privileged user can exploit path traversal in Kibana Fleet to trick admins into deleting unauthorized resources, including privileged accounts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-78591?
CVE-2026-78591 is a medium-severity path traversal vulnerability in Elastic Kibana, published on 2 Sep 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126). A low-privileged user could cause a subsequent action taken by a higher-privileged user in the Fleet administration interface to act on an unintended target, resulting in the deletion of resources including accounts with elevated privileges.
Weakness: CWE-22
Which versions are affected by CVE-2026-78591?
It affects 1 product.
Products include Elastic Kibana.
How do I fix CVE-2026-78591?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-78591 being exploited?
There is no known exploitation of CVE-2026-78591 in the wild and no public exploit code.
Other vulnerabilities in Elastic Kibana
Sources
Also known as GHSA-h75q-rv72-9xq7, MINI-364m-cjfr-jj4m, MINI-9q33-c6m7-5j6v, MINI-9xc6-7c9j-cqmj, MINI-g7p8-wp4q-g742, MINI-jq8h-885x-x874 and 2 more.