Vulnerability · Published Aug 13, 2026 · Assigned by elastic
CVE-2026-72677Relative Path Traversal in Kibana Fleet Leading to Unauthorized Deletion of Users and Other Resources
High 7.3
In plain English
A high-severity security flaw in Kibana from Elastic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Official description
Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored as provided and is later incorporated into the request that Kibana issues when that configuration is removed.
Affected products (as reported)
Weakness: CWE-23 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H