Kibana CVE-2026-72677

Exploitation requires a valid Kibana account with at least low-level privileges sufficient to access the Fleet management interface and create or manage Fleet Server host configurations (PR:L per CVSS vector). The Fleet feature must be enabled and accessible to the attacker. User interaction is required (UI:R per CVSS vector): the deletion of the malicious configuration must be triggered, meaning either the attacker performs the deletion themselves or induces another user to do so. Exploitation is bounded by: (1) mandatory Kibana authentication - anonymous or unauthenticated access is insufficient; (2) Fleet feature availability and access rights - environments that restrict Fleet to a small set of full admins have a materially reduced attack surface; (3) the need to trigger a deletion action, preventing fully passive exploitation.

The CVSS 7.3 score reflects a network-reachable, low-complexity attack requiring low privileges (PR:L) and user interaction (UI:R), with no confidentiality impact but High integrity and availability impact (I:H/A:H). The PR:L constraint confirms that unauthenticated exploitation is not possible - a valid Kibana account with Fleet access is required. The UI:R component means exploitation cannot be fully automated against a passive victim; the deletion action must be triggered, either by the attacker or by socially engineering a higher-privileged user. No EPSS score was provided in the input data, and the vulnerability is absent from the CISA KEV catalog, indicating no confirmed widespread exploitation. Taken together, this vulnerability is a genuine medium-high priority for organizations using Kibana Fleet in multi-tenant or shared-access deployments where low-privileged users can create Fleet Server host configurations, but is not an emergency-tier issue for environments with strict administrative controls over Fleet access.

An authenticated Kibana user with low-level Fleet access creates a Fleet Server host configuration and enters a crafted identifier such as '../../target-resource' in the host ID field. When the deletion of that configuration is later triggered - either by the attacker directly or by convincing an administrator to remove the entry - Kibana constructs a deletion request incorporating the traversal sequence, resulting in the deletion of an unintended Kibana resource rather than the intended Fleet Server host configuration. No public proof-of-concept has been identified at time of analysis.