CVE-2026-78592: Elastic Kibana Path Traversal Vulnerability

CVE-2026-78592 Overview

CVE-2026-78592 is a path traversal vulnerability [CWE-22] in Elastic Kibana that allows unauthorized deletion of privileged resources. A low-privileged user with tag creation privileges can craft input that causes a subsequent administrator action in the tag management interface to operate on an unintended target. The result is the deletion of privileged resources, including administrative accounts and other organizational assets. Exploitation requires an administrator to interact with the affected interface, making this a user-interaction dependent attack. Elastic patched the issue in Kibana 8.19.16, 9.3.5, and 9.4.2 under advisory ESA-2026-160.

Critical Impact
Low-privileged tag creators can weaponize administrator interactions to delete privileged Kibana resources, disrupting availability and integrity of security-critical Elastic Stack assets.

Affected Products

Elastic Kibana versions prior to 8.19.16
Elastic Kibana 9.x versions prior to 9.3.5
Elastic Kibana 9.4.x versions prior to 9.4.2

Discovery Timeline

2026-09-01 - CVE-2026-78592 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-78592

Vulnerability Analysis

The vulnerability resides in Kibana's tag management interface. Kibana treats tag identifiers or names as trusted path components when resolving the target of an administrative delete operation. An attacker with tag creation privileges can supply a crafted tag value containing traversal sequences that Kibana fails to normalize or restrict to the intended resource scope. When an administrator later interacts with the tag management interface, the delete action resolves to an unintended target outside the tag namespace.

The consequences are limited to integrity and availability. Confidentiality is not directly impacted. However, deleting administrative accounts or organizational assets can disrupt access control, break dashboards and saved objects, and hinder incident response workflows that depend on Kibana.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. Kibana does not sufficiently validate or canonicalize the attacker-controlled tag identifier before using it to reference a stored object for deletion. Path traversal sequences pass through into the resource lookup, allowing the operation to escape the tag scope.

Attack Vector

The attack maps to CAPEC-126 (Path Traversal). The attacker requires an authenticated Kibana account with tag creation privileges, a low-privilege role in most deployments. The attacker plants a malicious tag whose identifier resolves to a privileged resource. The attack then relies on an administrator to open the tag management interface and confirm a delete action, at which point the crafted target is removed. No verified public proof-of-concept is available at the time of publication.

Verified technical details are available in the Elastic Security Update ESA-2026-160.

Detection Methods for CVE-2026-78592

Indicators of Compromise

Unexpected deletion events for Kibana saved objects, roles, users, or spaces recorded in Elasticsearch audit logs.
Newly created tags with unusual identifiers containing traversal sequences such as .., %2e%2e, or path separators.
Tag creation activity by low-privileged accounts followed shortly by administrator sessions in the tag management interface.
Missing administrative accounts or dashboards without a corresponding change record.

Detection Strategies

Enable Elastic Stack audit logging and alert on saved_object_delete and user or role deletion events that originate from tag management workflows.
Correlate tag creation events by non-admin users with subsequent administrator delete actions within a short time window.
Baseline expected tag naming patterns and flag identifiers that contain path separators or URL-encoded traversal sequences.

Monitoring Recommendations

Forward Kibana and Elasticsearch audit logs to a centralized analytics platform for retention and correlation.
Monitor Kibana version banners across environments to identify hosts still running vulnerable builds.
Track privilege changes and administrative resource deletions as high-priority security events.

How to Mitigate CVE-2026-78592

Immediate Actions Required

Upgrade Kibana to 8.19.16, 9.3.5, or 9.4.2, whichever aligns with the deployed release train.
Review recent tag creation activity by non-administrator users and inspect associated identifiers for traversal sequences.
Audit Kibana user, role, and saved-object inventories against a known-good baseline to identify unauthorized deletions.

Patch Information

Elastic released fixed versions under advisory ESA-2026-160. Apply Kibana 8.19.16, 9.3.5, or 9.4.2 per the Elastic Security Update ESA-2026-160. Restart Kibana instances after upgrade and verify the running version through the About page or the /api/status endpoint.

Workarounds

Restrict tag creation privileges to trusted users by reviewing Kibana role definitions and removing the tag write privilege from low-trust roles.
Instruct administrators to avoid interacting with the tag management interface on unpatched systems until upgrades complete.
Increase audit log retention and enable alerting on saved-object deletions to detect exploitation attempts pending patch deployment.

bash

# Verify Kibana version after upgrade
curl -sk -u kibana_admin https://kibana.example.local:5601/api/status | jq '.version.number'

# Expected output examples for patched builds:
# "8.19.16"
# "9.3.5"
# "9.4.2"