CVE-2026-78590: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Elastic Kibana

This vulnerability (CWE-22) in Elastic Kibana's Fleet feature involves improper limitation of a pathname to a restricted directory, enabling path traversal attacks. A low-privileged user with write access to Fleet Settings can manipulate the pathname so that a subsequent administrative action deletes privileged resources such as user accounts and organizational assets. Successful exploitation depends on an administrator interacting with the affected Fleet interface, which triggers the unintended deletion. The CVSS 3.1 score is 7.3 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H), indicating network attack vector, low attack complexity, low privileges required, user interaction needed, unchanged scope, no confidentiality impact, but high integrity and availability impact.

The vulnerability can lead to unauthorized deletion of privileged resources including user accounts and other organizational assets. This impacts the integrity and availability of the affected system components. There is no direct confidentiality impact reported. Exploitation requires a low-privileged user and an administrator's interaction with the Fleet interface, making the attack scenario somewhat constrained.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict Fleet Settings write access to trusted users only and limit administrator interactions with the Fleet interface to trusted personnel. Monitor vendor advisories for updates on remediation.