{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/elastic-kibana/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-115294"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Kibana"],"_cs_severities":["high"],"_cs_tags":["path-traversal","cve-2026-115294","elastic-kibana","vulnerability","web-application","security-advisory"],"_cs_type":"advisory","_cs_vendors":["Elastic"],"content_html":"\u003cp\u003eA path traversal vulnerability exists in the Kibana Fleet feature, tracked as CVE-2026-115294. A user with low-privileged access to modify Fleet agent policies can manipulate resource paths. When an administrator subsequently interacts with the affected Fleet interface, these manipulated paths can result in the deletion of unauthorized resources, such as Kibana spaces and other organizational assets.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows low-privileged users to bypass access controls and trigger the unauthorized deletion of resources they are not otherwise authorized to modify or delete.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInventory all instances of Kibana where the Fleet feature is enabled.\u003c/li\u003e\n\u003cli\u003eReview and restrict access to Fleet agent policy management to only essential administrative roles until a security update is applied.\u003c/li\u003e\n\u003cli\u003eMonitor administrative logs for unexpected deletion of Kibana spaces or management assets initiated by low-privileged user contexts.\u003c/li\u003e\n\u003cli\u003eApply the forthcoming patch from Elastic once released to address the path traversal (CWE-22) in the Fleet feature.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-11-04T16:16:48Z","date_published":"2026-11-03T18:05:23Z","id":"https://feed.craftedsignal.io/briefs/2026-11-kibana-path-traversal/","summary":"CVE-2026-115294 is a path traversal vulnerability in the Kibana Fleet feature that allows low-privileged users with agent policy write access to manipulate administrative actions, resulting in unauthorized resource deletion.","title":"Elastic Kibana: Path traversal in Fleet feature (CVE-2026-115294)","url":"https://feed.craftedsignal.io/briefs/2026-11-kibana-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Elastic-Kibana","version":"https://jsonfeed.org/version/1.1"}