EUVD-2026-70062
GHSA-h75q-rv72-9xq7
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
Vendor-provided vector is accurate: low-priv network attacker plants payload (PR:L/AV:N), admin trigger required (UI:R), deletion-only impact with no data exfiltration (C:N/I:H/A:L).
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
2DescriptionCVE.org
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126). A low-privileged user could cause a subsequent action taken by a higher-privileged user in the Fleet administration interface to act on an unintended target, resulting in the deletion of resources including accounts with elevated privileges.
AnalysisAI
Path traversal in Kibana's Fleet feature enables a low-privileged user to manipulate Fleet administration actions taken by higher-privileged users, causing those actions to target unintended resources - including deleting accounts with elevated privileges. The attack exploits a confused-deputy pattern (CWE-22/CAPEC-126): the attacker crafts a traversal payload through their low-privileged access, then waits for an admin to perform a routine Fleet operation, at which point the admin's elevated context executes the deletion against the attacker-controlled target. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid low-privileged Kibana account with at minimum Fleet read/write access to plant the traversal payload. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.3 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L) accurately characterizes this as a medium-severity issue, though its real-world impact is disproportionately high when exploitation succeeds: deleting accounts with elevated privileges can disrupt security operations or lock legitimate admins out of Fleet management. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Kibana 8.19.17, 9.3.6, or 9.4.3 per the Elastic advisory ESA-2026-159 (https://discuss.elastic.co/t/kibana-8-19-17-9-3-6-9-4-3-security-update-esa-2026-159/390114). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. Rated criti
Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. Rated hig
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. Rated critical s
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP
Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are us
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine lea
Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. Rated critical sever
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. Rate
Privilege escalation in Elastic Kibana's Agent Builder component (versions 9.4.0-9.4.3) allows authenticated low-privile
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document con
Kibana version 8.7.0 contains an arbitrary code execution flaw. Rated high severity (CVSS 8.8), this vulnerability is re
Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. Rated high severity (CVSS 8.8), this vulne
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today