Elk: Relative Path Traversal in Kibana Fleet Leading to Unauthorized Deletion of Users and Other Resources (CVE-2026-72677)

CVE-2026-72677 is a Relative Path Traversal vulnerability (CWE-23) in Kibana Fleet. The vulnerability arises because Kibana Fleet accepts user-supplied identifiers for Fleet Server host configurations without validating or rejecting relative path traversal sequences. These identifiers are stored as-is and incorporated into requests issued by Kibana when removing configurations. This flaw can be exploited to delete unauthorized Kibana resources, including users and other critical data. The affected versions include Kibana >=8.0.0 <8.19.17, >=9.0.0 <9.3.6, and >=9.4.0 <9.4.3. No CVSS score is provided, but the severity is classified as high. A patch is available to remediate this issue.

Exploitation of this vulnerability can lead to unauthorized deletion of Kibana resources, including users and other critical configurations. This can disrupt normal operations and potentially cause loss of important data within Kibana environments.

A patch is available for this vulnerability. Users should upgrade Kibana to versions 8.19.17 or later, 9.3.6 or later, and 9.4.3 or later as applicable. Applying these official fixes will prevent exploitation of the relative path traversal flaw. No additional vendor advisories indicate that no action is required.