CVE-2026-78591 Overview
CVE-2026-78591 is a path traversal vulnerability [CWE-22] in the Kibana Fleet feature from Elastic. A low-privileged user can manipulate resource identifiers to redirect actions performed by higher-privileged administrators in the Fleet interface. The result is unauthorized deletion of resources, including accounts holding elevated privileges. Exploitation requires user interaction from a privileged Fleet operator, but network access and only low-level authenticated permissions are needed to stage the attack.
Critical Impact
An authenticated low-privileged attacker can trick a Fleet administrator into deleting unintended resources, including privileged accounts, resulting in integrity loss and partial availability impact across the Kibana Fleet management surface.
Affected Products
- Kibana 8.19 (fixed in 8.19.17)
- Kibana 9.3 (fixed in 9.3.6)
- Kibana 9.4 (fixed in 9.4.3)
Discovery Timeline
- 2026-09-02 - CVE-2026-78591 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-78591
Vulnerability Analysis
The vulnerability affects the Fleet administration interface in Kibana. Fleet manages Elastic Agents, integrations, agent policies, and related resources through a REST API and UI. Improper validation of resource identifiers allows path traversal sequences to be embedded in fields that are later concatenated into resource paths.
A low-privileged user submits crafted input containing traversal sequences. When a higher-privileged Fleet administrator later performs a routine action such as deleting an agent, integration, or policy, the traversal payload causes the delete operation to target a different resource than the administrator intended. The affected target can include accounts with elevated privileges.
The attack requires authentication with limited Fleet permissions and user interaction from an administrator. The scope is unchanged, but integrity impact is high because attackers can eliminate privileged accounts or critical Fleet resources.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. Kibana Fleet does not sufficiently sanitize or canonicalize user-supplied identifiers before using them in privileged deletion operations. Traversal characters bypass the intended resource boundary.
Attack Vector
The attack chain follows CAPEC-126 (Path Traversal). A low-privileged authenticated user injects traversal payloads into a Fleet resource field. The malicious value persists in the Fleet management state. When an administrator interacts with the Fleet interface and initiates a delete action on a resource associated with the attacker's input, the server resolves the path outside the intended directory. The privileged deletion executes against the attacker-controlled target.
No verified public exploit or proof-of-concept has been published. See the Elastic Security Update ESA-2026-159 for vendor technical details.
Detection Methods for CVE-2026-78591
Indicators of Compromise
- Unexpected deletion of Fleet resources, agent policies, integrations, or user accounts with elevated privileges.
- Kibana audit log entries showing Fleet delete API calls where the resource path contains ../ or URL-encoded traversal sequences (%2e%2e%2f, %2e%2e/).
- Fleet resource identifiers containing atypical characters or path separators submitted by low-privileged users.
Detection Strategies
- Enable Kibana audit logging and forward events to a centralized analytics platform. Alert on Fleet delete operations that resolve to privileged principals or unexpected resource classes.
- Correlate low-privileged user input events with subsequent administrator delete actions occurring within a short time window.
- Baseline normal Fleet API request patterns and flag requests containing traversal metacharacters in identifier fields.
Monitoring Recommendations
- Monitor Kibana version strings across all deployments and alert on instances running versions earlier than 8.19.17, 9.3.6, or 9.4.3.
- Track administrative account inventory changes and privilege modifications tied to Fleet operations.
- Review web proxy and reverse proxy logs for HTTP requests to Fleet API endpoints containing encoded traversal payloads.
How to Mitigate CVE-2026-78591
Immediate Actions Required
- Upgrade Kibana to version 8.19.17, 9.3.6, or 9.4.3 as documented in the vendor advisory.
- Audit Fleet-related role assignments and remove unnecessary low-privileged access to Fleet.
- Review recent Fleet deletion events and validate that all removed resources were intentional.
Patch Information
Elastic released fixed builds in Kibana 8.19.17, 9.3.6, and 9.4.3. Details are provided in the Elastic Security Update ESA-2026-159. Apply the patch corresponding to your deployed release branch.
Workarounds
- Restrict Fleet write and management permissions to a minimal set of trusted administrators until patches are applied.
- Require administrators to confirm resource identifiers out-of-band before executing bulk or high-impact deletions in the Fleet interface.
- Place Kibana behind a reverse proxy that blocks requests containing path traversal sequences in API parameters.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
