Kibana Fleet CVE-2026-78591

The attacker must hold a valid low-privileged Kibana account with at minimum Fleet read/write access to plant the traversal payload. The Fleet feature must be actively used in the Kibana deployment - environments that have Fleet disabled or use Kibana solely for dashboard/visualization purposes are not exposed. Critically, a higher-privileged user (with Fleet administrator rights) must perform a subsequent action in the Fleet administration UI after the payload is planted; without this second-user trigger, the attacker cannot cause any resource deletion. This UI:R dependency limits exploitation to environments where Fleet is routinely administered and constrains automated or unauthenticated attack paths. Exploitation is further bounded to the deletion of resources (including elevated accounts) - there is no confidentiality impact (C:N), so credential or data exfiltration is not part of this attack.

The CVSS 6.3 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L) accurately characterizes this as a medium-severity issue, though its real-world impact is disproportionately high when exploitation succeeds: deleting accounts with elevated privileges can disrupt security operations or lock legitimate admins out of Fleet management. The UI:R requirement is the primary limiting factor - the attacker cannot act autonomously and must time their payload to coincide with a higher-privileged user's Fleet activity, making opportunistic mass exploitation difficult. No CISA KEV listing and no public POC are identified, and EPSS data is not provided, so exploitation probability cannot be quantified precisely. However, the integrity impact ceiling (I:H - privileged account deletion) warrants prioritized patching in any environment where Fleet is actively administered, as the actual blast radius of a successful attack exceeds what the 6.3 base score alone conveys.

An attacker with a low-privileged Kibana account that has Fleet read/write access crafts and submits a path-traversal resource identifier targeting an elevated-privilege account or critical resource. When a Fleet administrator subsequently performs a routine management action - such as updating a policy or removing an enrollment token - the Fleet backend resolves the attacker-planted traversal path instead of the intended target, causing the administrator's deletion action to remove the targeted privileged account. The attacker regains impact after the admin's next login failure confirms the deletion succeeded. No public POC is identified at time of analysis.