CVE-2026-78591: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Elastic Kibana

This vulnerability (CWE-22) in Elastic Kibana's Fleet feature involves improper limitation of a pathname to a restricted directory, enabling path traversal (CAPEC-126). A low-privileged user can exploit this flaw to manipulate subsequent actions performed by a higher-privileged user in the Fleet administration interface, causing deletion of unintended resources such as privileged accounts. The vulnerability is confirmed in Kibana versions 8.0.0, 9.0.0, and 9.4.0. No patch or official remediation level has been provided as of the published date.

Exploitation of this vulnerability can result in unauthorized deletion of resources, including accounts with elevated privileges, potentially disrupting system integrity and administrative control. The impact is limited to integrity and availability, with no confidentiality impact noted. The CVSS score of 6.3 reflects a medium severity level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Fleet feature to trusted users only and monitor for suspicious activity involving resource deletions. Avoid allowing low-privileged users to interact with the Fleet administration interface in a way that could trigger higher-privileged actions.