CVE-2026-72677
published 2026-08-13CVE-2026-72677: Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet…
PriorityP343high7.3CVSS 3.1
AVNACLPRLUIRSUCNIHAH
EPSS
0.40%
33.6th percentile
Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored as provided and is later incorporated into the request that Kibana issues when that configuration is removed.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | kibana | >= 8.0.0 < 8.19.17 | 8.19.17 |
| elastic | kibana | 8.0.0 – 8.19.16 | — |
| elastic | kibana | >= 9.0.0 < 9.3.6 | 9.3.6 |
| elastic | kibana | 9.0.0 – 9.3.5 | — |
| elastic | kibana | >= 9.4.0 < 9.4.3 | 9.4.3 |
| elastic | kibana | 9.4.0 – 9.4.2 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Elastic Kibana up to 8.19.16/9.3.5/9.4.2 Fleet path traversal (EUVD-2026-58264)
vuldb·2026-08-13·CVSS 7.3
CVE-2026-72677 [HIGH] Elastic Kibana up to 8.19.16/9.3.5/9.4.2 Fleet path traversal (EUVD-2026-58264)
A vulnerability has been found in Elastic Kibana up to 8.19.16/9.3.5/9.4.2 and classified as problematic. The impacted element is an unknown function of the component Fleet. Performing a manipulation results in relative path traversal.
This vulnerability is reported as CVE-2026-72677. The attack is possible to be carried out remotely. No exploit exists.
GHSA
Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139).
ghsa_unreviewed·2026-08-13
CVE-2026-72677 [HIGH] CWE-23 Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139).
Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored as provided and is later incorporated into the request that Kibana issues when that configuration is removed.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-13
Published