Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal (CAPEC-126). A low-privileged user could cause a subsequent action taken by a higher-privileged user in the Fleet administration interface to act on an unintended target, resulting in the deletion of resources including accounts with elevated privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-02T15:17:40.570Z",
  "pubdate": "2026-09-02T15:17:40.570Z",
  "executiveSummary": "This vulnerability involves an Improper Limitation of a Pathname to a Restricted Directory (CWE-22) within the Kibana Fleet feature.\nThe flaw enables a Path Traversal (CAPEC-126) attack, allowing a low-privileged user to manipulate file paths to target unauthorized resources.\nThe primary security impact is the potential for unauthorized resource deletion, including the removal of accounts with elevated administrative privileges.\nThe attack operates by coercing a higher-privileged user, such as an administrator, into performing an action via the Fleet interface that unintentionally interacts with a malicious path defined by the attacker.\nThis represents a significant risk to system integrity and administrative access control, as the application fails to sufficiently sanitize user-supplied path inputs before processing administrative requests.\nSuccessful exploitation requires the attacker to have at least low-privileged access to the Kibana instance and relies on the interaction with an authorized administrative user to trigger the malicious outcome.",
  "technicalDetails": "The vulnerability resides in the Kibana Fleet feature and is rooted in the failure to properly validate or sanitize path inputs. By exploiting this Path Traversal (CWE-22) flaw, an attacker can bypass intended directory restrictions, effectively escaping the confined scope of the Fleet management interface.\nThe exploitation mechanism leverages the trust boundary between standard user inputs and administrative-level operations. A low-privileged user constructs a malicious request containing directory traversal sequences (e.g., '../') that, when stored or processed by the Fleet feature, redirects subsequent operations to unauthorized file system locations.\nThe attack flow proceeds as follows: First, the low-privileged attacker submits an input via the Fleet interface that includes a crafted, malicious path designed to point to a critical system resource or an account database. Second, the system stores this malicious reference without sufficient validation. Third, the attacker waits for a higher-privileged administrator to interact with the Fleet administration interface. When the administrator performs a management action—such as deleting or modifying a resource—the application retrieves the attacker-supplied, manipulated path.\nBecause the system performs this operation under the context of the privileged administrative user, the application processes the request against the unintended target. This results in the unauthorized deletion of resources. In severe scenarios, this can be leveraged to delete accounts with elevated privileges, effectively performing an administrative-level action without the administrator's awareness or consent.\nThis vulnerability effectively acts as a confusion attack where the system's logic is tricked into applying authorized operations to unauthorized targets. The lack of path canonicalization and restricted access validation within the Fleet backend components facilitates this bypass. The vulnerability is network-exposed, as it is accessible through the standard Kibana interface, necessitating that attackers maintain low-level authentication to initiate the injection of the traversal payload. Post-exploitation impact is critical, as it allows for the destruction of configuration data and the compromise of administrative accounts, potentially leading to a full loss of integrity for the Kibana deployment."
}