Kibana EUVD-2026-69573

Two specific conditions must both be met: (1) the attacker must hold a Kibana account with tag creation privileges - a low-privileged but non-default permission (PR:L per CVSS), meaning deployments that restrict tag creation to admins are not exploitable; and (2) an administrator must subsequently perform a management action in the tag management interface on the attacker-controlled tag (UI:R per CVSS) - importantly, this does not require the admin to click an external link or receive a phishing message, as ordinary use of the tag management UI is sufficient to trigger the payload. Exploitation is entirely blocked if tag creation is restricted to administrative roles. Exploitation is also limited to Kibana instances where the tag management interface is accessible and actively used by administrators.

The CVSS 7.3 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H) accurately captures the core risk profile: network-reachable with low complexity but critically dependent on administrator interaction (UI:R), which is the primary factor preventing autonomous exploitation at scale. The high integrity and availability scores reflect that the resulting action is irreversible deletion of privileged resources. EPSS data was not provided in the source intelligence, and this CVE is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. The absence of a public POC further reduces near-term automated threat probability. Despite these mitigating signals, the severity of the achievable impact - deleting admin accounts - means even a mid-sized municipal IT team in koszalin managing a shared Kibana instance should treat this as urgent, particularly in environments where tag creation permissions are granted broadly to analysts or developers. The UI:R dependency limits large-scale weaponization but does not require a phishing step - natural administrative use of the tag interface is sufficient to trigger the payload.

An attacker with a Kibana analyst account holding tag creation privileges creates a tag whose name encodes a path traversal sequence targeting an administrative account object (e.g., a name resolving to ../../admin-user or equivalent API path). When an administrator later opens the tag management interface and performs a routine delete or cleanup operation on what appears to be a legitimate tag, the backend resolves the traversal payload and permanently deletes the targeted administrator account or organizational asset instead. No public POC has been identified, but the attack pattern is conceptually straightforward for anyone familiar with second-order injection techniques.