CVE-2026-78590 Overview
CVE-2026-78590 is a path traversal vulnerability (CWE-22) in the Kibana Fleet feature. A low-privileged user holding Fleet Settings write access can manipulate pathnames so that a subsequent administrator action operates on unintended internal resources. Successful exploitation results in the deletion of privileged resources, including user accounts and other organizational assets. Exploitation requires an administrator to interact with the affected Fleet interface, satisfying the user interaction requirement.
Critical Impact
Attackers with Fleet Settings write access can trick administrators into deleting privileged resources such as user accounts, degrading integrity and availability across the Elastic Stack deployment.
Affected Products
- Kibana 8.19 (fixed in 8.19.18)
- Kibana 9.3 (fixed in 9.3.6)
- Kibana 9.4 (fixed in 9.4.3)
Discovery Timeline
- 2026-09-02 - CVE-2026-78590 published to NVD
- 2026-09-02 - Last updated in NVD database
- Vendor advisory: Elastic Security Update ESA-2026-158
Technical Details for CVE-2026-78590
Vulnerability Analysis
The vulnerability resides in the Kibana Fleet feature, which manages Elastic Agents and their configurations. Fleet Settings write permission is intended for operational configuration, not for altering system-wide resource identifiers. However, insufficient validation of pathname inputs allows a low-privileged operator to inject traversal sequences into stored settings. When an administrator later performs a routine action through the Fleet interface, the tainted pathname redirects the operation to resources outside the intended directory scope.
The impact is scoped to integrity and availability. Confidentiality is not directly affected, but the deletion of user accounts or organizational assets can cascade into broader operational disruption. Because the malicious action executes under administrator context, standard audit trails may attribute the destructive operation to the administrator rather than the original low-privileged actor.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory (CWE-22). Fleet accepts settings values that are later consumed as resource identifiers without normalization or canonicalization. Traversal sequences such as ../ are not rejected, allowing references to internal resources outside the expected Fleet scope.
Attack Vector
Exploitation follows the Path Traversal pattern described in CAPEC-126. An attacker authenticates with Fleet Settings write access and stores a crafted value containing traversal segments. The payload remains inert until an administrator interacts with the affected Fleet interface, at which point the administrator's privileged action operates on the attacker-chosen resource. The vulnerability is network-accessible and requires low privileges plus administrator interaction. No verified public exploit is available at the time of publication. See the Elastic Security Update ESA-2026-158 for authoritative technical detail.
Detection Methods for CVE-2026-78590
Indicators of Compromise
- Unexpected deletion of Kibana user accounts, roles, or Fleet-managed policies without a corresponding change-management record.
- Fleet Settings entries containing path traversal sequences such as ../ or URL-encoded variants like %2e%2e%2f.
- Audit log entries showing administrator-initiated delete operations shortly after Fleet Settings modifications by lower-privileged users.
Detection Strategies
- Review Kibana audit logs (xpack.security.audit.enabled: true) for saved_object_delete and user management events correlated with prior Fleet Settings writes.
- Alert on Fleet Settings API calls whose payloads include traversal characters or references outside the expected Fleet resource namespace.
- Baseline the population of Fleet Settings writers and flag any account exercising that privilege that does not perform routine agent policy work.
Monitoring Recommendations
- Forward Kibana audit and Elasticsearch security logs to a centralized analytics platform for retention and correlation.
- Monitor the delta between Fleet Settings write events and subsequent administrator actions in the Fleet UI to identify chained abuse.
- Track privileged resource inventories (users, roles, spaces) for unexplained removals and reconcile against change tickets.
How to Mitigate CVE-2026-78590
Immediate Actions Required
- Upgrade Kibana to 8.19.18, 9.3.6, or 9.4.3 per the Elastic advisory.
- Audit which accounts hold Fleet Settings write access and revoke the privilege from users who do not require it.
- Review recent Fleet Settings changes and administrator actions for evidence of exploitation before patching.
Patch Information
Elastic fixed CVE-2026-78590 in Kibana 8.19.18, 9.3.6, and 9.4.3. Consult the Elastic Security Update ESA-2026-158 for upgrade guidance and version-specific notes.
Workarounds
- Restrict the Fleet Settings write privilege to a minimal set of trusted operators until the upgrade is complete.
- Instruct administrators to avoid interacting with the Fleet interface if unverified low-privileged changes are pending review.
- Enable Kibana audit logging and require change tickets for any Fleet Settings modification.
# Configuration example: enable Kibana audit logging to support detection
# kibana.yml
xpack.security.audit.enabled: true
xpack.security.audit.appender.type: rolling_file
xpack.security.audit.appender.fileName: /var/log/kibana/audit.log
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
