CVE-2026-78599: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Elastic Kibana

This vulnerability (CWE-22) in Elastic Kibana's Fleet feature involves improper limitation of a pathname to a restricted directory, enabling path traversal attacks. A low-privileged user with Fleet write permissions can manipulate the pathname such that when an administrator performs a delete action through the Fleet interface, internal resources outside the intended scope may be deleted. This requires the involvement of an administrator to trigger the unintended deletion. The vulnerability affects Kibana versions 8.0.0 and 9.0.0. No official remediation or patch has been documented yet.

The vulnerability can lead to unauthorized deletion of internal resources within Kibana, potentially causing denial of service or loss of critical data. However, exploitation requires a low-privileged user with Fleet write access and an administrator to perform a delete action, limiting the attack vector. There is no impact on confidentiality or integrity, but availability is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Fleet write access to trusted users and ensure administrators are cautious when performing delete actions in the Fleet interface. Monitor for unusual delete operations involving internal resources.