EUVD-2026-69573
GHSA-4hm7-wqvw-mrw2
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
PR:L for required tag-creation account; UI:R for mandatory admin interaction; C:N as no data is disclosed; I:H and A:H reflect irreversible deletion of admin accounts and org assets.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
2DescriptionCVE.org
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal (CAPEC-126). A low-privileged user holding tag creation privileges could cause a subsequent administrative action in the tag management interface to act on an unintended target, resulting in the deletion of privileged resources including administrative accounts and other organizational assets. Exploitation requires an administrator to interact with the affected interface.
AnalysisAI
Second-order path traversal in Kibana allows a low-privileged user with tag creation rights to cause an administrator's routine tag management action to operate on an unintended privileged resource, resulting in permanent deletion of administrator accounts or other organizational assets. Affected versions span the Elastic Stack deployment across the 8.x and 9.x series, with patches released in Kibana 8.19.16, 9.3.5, and 9.4.2. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two specific conditions must both be met: (1) the attacker must hold a Kibana account with tag creation privileges - a low-privileged but non-default permission (PR:L per CVSS), meaning deployments that restrict tag creation to admins are not exploitable; and (2) an administrator must subsequently perform a management action in the tag management interface on the attacker-controlled tag (UI:R per CVSS) - importantly, this does not require the admin to click an external link or receive a phishing message, as ordinary use of the tag management UI is sufficient to trigger the payload. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.3 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H) accurately captures the core risk profile: network-reachable with low complexity but critically dependent on administrator interaction (UI:R), which is the primary factor preventing autonomous exploitation at scale. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Kibana to version 8.19.16, 9.3.5, or 9.4.2 depending on the installed series, per Elastic advisory ESA-2026-160 at https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-9-4-2-security-update-esa-2026-160/390077. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Kibana instances running vulnerable versions (8.0-8.19.15, 9.0-9.4.1) and audit which users hold tag creation permissions, restricting access to trusted administrators only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. Rated criti
Kibana versions 6.7.0 to 6.8.8 and 7.0.0 to 7.6.2 contain a prototype pollution flaw in the Upgrade Assistant. Rated hig
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. Rated critical s
Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP
Kibana versions 4.0 to 4.6, 5.0 to 5.6.12, and 6.0 to 6.4.2 contain an error in the way authorization credentials are us
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine lea
Kibana versions before 6.6.1 contain an arbitrary code execution flaw in the security audit logger. Rated critical sever
Prototype Pollution in Kibana can lead to code injection via unrestricted file upload combined with path traversal. Rate
Privilege escalation in Elastic Kibana's Agent Builder component (versions 9.4.0-9.4.3) allows authenticated low-privile
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document con
Kibana version 8.7.0 contains an arbitrary code execution flaw. Rated high severity (CVSS 8.8), this vulnerability is re
Kibana versions 8.0.0 through 8.7.0 contain an arbitrary code execution flaw. Rated high severity (CVSS 8.8), this vulne
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today