CVE-2026-78592 Path traversal in Kibana
A path traversal flaw in Kibana allows low-privileged users to delete privileged resources, including admin accounts, by tricking an administrator into interacting with the tag management interface.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-78592?
CVE-2026-78592 is a high-severity path traversal vulnerability in Elastic Kibana, published on 1 Sep 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low-privileged user holding tag creation privileges could cause a subsequent administrative action in the tag management interface to act on an unintended target, resulting in the deletion of privileged resources including administrative accounts and other organizational assets. Exploitation requires an administrator to interact with the affected interface.
Weakness: CWE-22
Which versions are affected by CVE-2026-78592?
It affects 1 product.
Products include Elastic Kibana.
How do I fix CVE-2026-78592?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-78592 being exploited?
There is no known exploitation of CVE-2026-78592 in the wild and no public exploit code.
Other vulnerabilities in Elastic Kibana
Sources
Also known as GHSA-4hm7-wqvw-mrw2, MINI-7gg7-6hfw-7pxj, MINI-9hp2-3vf7-3vpv, MINI-c2hg-jxj4-pq5m, MINI-fjcx-6ff7-7wmj, MINI-g44g-cpcv-5mg5 and 3 more.