Vulnerabilities CVE-2026-72677

CVE-2026-72677

High

Open

TLP:CLEAR

Relative Path Traversal in Kibana Fleet Leading to Unauthorized Deletion of Users and Other Resources

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored as provided and is later incorporated into the request that Kibana issues when that configuration is removed.

Details

CVSS Score: 7.3
EPSS Score ⓘ: 0.27%

19.5th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
Confidence: 90%
Published: Aug 13, 2026
Last Modified: Aug 13, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.