Elastic Kibana: Path traversal in Fleet feature (CVE-2026-115294)
CVE-2026-115294 is a path traversal vulnerability in the Kibana Fleet feature that allows low-privileged users with agent policy write access to manipulate administrative actions, resulting in unauthorized resource deletion.
CVE search metadata
CVE search record: CVE-2026-115294. Severity: high. CVSS: 7.3. KEV: no. Product: Kibana. Brief: Elastic Kibana: Path traversal in Fleet feature (CVE-2026-115294). Brief link: https://feed.craftedsignal.io/briefs/2026-11-kibana-path-traversal/
Triage facts
Revision 2- Applicability
- Kibana
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 2Nov 4, 16:18 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Revision history 1 entry · Revision 2
- Revision 2
added coverage for Kibana
Changed: action_plan, lastmod, priority_signals, references, tags, updates
Sources: 1
A path traversal vulnerability exists in the Kibana Fleet feature, tracked as CVE-2026-115294. A user with low-privileged access to modify Fleet agent policies can manipulate resource paths. When an administrator subsequently interacts with the affected Fleet interface, these manipulated paths can result in the deletion of unauthorized resources, such as Kibana spaces and other organizational assets.
Impact
Successful exploitation allows low-privileged users to bypass access controls and trigger the unauthorized deletion of resources they are not otherwise authorized to modify or delete.
Recommendation
- Inventory all instances of Kibana where the Fleet feature is enabled.
- Review and restrict access to Fleet agent policy management to only essential administrative roles until a security update is applied.
- Monitor administrative logs for unexpected deletion of Kibana spaces or management assets initiated by low-privileged user contexts.
- Apply the forthcoming patch from Elastic once released to address the path traversal (CWE-22) in the Fleet feature.
Immediate actions
Restrict Fleet agent policy write access to high-privileged administrative accounts.
Perform an inventory of all Kibana versions in the environment.
Threat Hunt
Monitor Kibana audit logs for delete actions performed on spaces or assets by low-privileged user accounts.
Data: Kibana audit/access logs, Fleet API activity logs
Enrichment needed
- CVE identifiers and patched versions (CTI) Necessary to determine the urgency and specific remediation path.
Mitigations
Apply security patches for CVE-2026-115294 immediately upon release by Elastic.
CVE-2026-115294
Apply future security updates provided by Elastic for Kibana once released.
Multiple reported vulnerabilities
Gaps
- Missing version-specific scope for remediation.