# CVE-2026-78591: Elastic Kibana path traversal in Fleet feature

Source: https://junglewise.ai/threats/cve-2026-78591-elastic-kibana-path-traversal-in-fleet-feature  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78591 · Severity: medium · CVSS 6.3 · Published 2026-09-02

Kibana, Elastic's data visualization and administration tool, contains a path traversal vulnerability in its Fleet feature that allows low-privileged users to manipulate file paths. An attacker could trick a higher-privileged administrator into deleting unintended resources, including accounts with elevated permissions, by crafting malicious path inputs that bypass directory restrictions. This could lead to unauthorized account deletion and disruption of critical administrative functions.

Technologies: [Elastic Kibana](https://junglewise.ai/threats/technologies/kibana). Vendors: [Elastic](https://junglewise.ai/threats/vendors/elastic).

## Quick answers

**Is CVE-2026-78591 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78591 being exploited in the wild.

**How severe is CVE-2026-78591?** Medium severity, with a CVSS score of 6.3, published 2 September 2026.

**Which products and versions are affected?** Elastic Kibana 8.0.0 to 8.19.16, 9.0.0 to 9.3.5, 9.4.0 to 9.4.2.

**Is there a fix for CVE-2026-78591?** A patch was published on 2026-09-02: Fixed in Kibana 8.19.17, 9.3.6, and 9.4.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78591 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-78591?** Check whether you run Elastic Kibana at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path traversal flaw (CWE-22) in Kibana's Fleet administration feature that fails to properly restrict pathname inputs. An attacker with low privileges can craft a malicious path that exploits this validation weakness, causing a subsequent action by a higher-privileged user (requiring user interaction via the Fleet admin interface) to operate on an unintended target directory or resource. The vulnerability enables unauthorized deletion of arbitrary resources, including high-privilege user accounts. Attack vector is network-based with low privilege requirement and requires user interaction (UI:R). Patches are available in Kibana 8.19.17, 9.3.6, and 9.4.3; no workarounds exist for affected deployments with Fleet enabled.

## Affected products

- Elastic Kibana 8.0.0 to 8.19.16, 9.0.0 to 9.3.5, 9.4.0 to 9.4.2

## Timeline

- 2026-09-02: disclosed: CVE-2026-78591 disclosed publicly
- 2026-09-02: patched: Fixed in Kibana 8.19.17, 9.3.6, and 9.4.3

## References

- [https://discuss.elastic.co/t/kibana-8-19-17-9-3-6-9-4-3-security-update-esa-2026-159/390114](https://discuss.elastic.co/t/kibana-8-19-17-9-3-6-9-4-3-security-update-esa-2026-159/390114)

## Related threats

- [Elastic Kibana authorization bypass in connector logs](https://junglewise.ai/threats/cve-2026-115295-authorization-bypass-through-user-controlled-key-cwe-639-in)
- [Elastic Kibana path traversal in Fleet feature](https://junglewise.ai/threats/cve-2026-115294-improper-limitation-of-a-pathname-to-a-restricted-directory-cwe)
- [Elastic Kibana credential disclosure in Observability onboarding](https://junglewise.ai/threats/cve-2026-115293-insertion-of-sensitive-information-into-sent-data-cwe-201-in)
- [Elastic Kibana authorization bypass in Machine Learning](https://junglewise.ai/threats/cve-2026-115292-authorization-bypass-through-user-controlled-key-cwe-639-in)
- [Elastic Kibana incorrect authorization in Fleet settings](https://junglewise.ai/threats/cve-2026-102412-incorrect-authorization-cwe-863-in-kibana-can-lead-to-sensitive)