Elastic-Kibana - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/elastic-kibana/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 18:05:23 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgElastic Kibana: Path traversal in Fleet feature (CVE-2026-115294)https://feed.craftedsignal.io/briefs/2026-11-kibana-path-traversal/Tue, 03 Nov 2026 18:05:23 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-kibana-path-traversal/CVE-2026-115294 is a path traversal vulnerability in the Kibana Fleet feature that allows low-privileged users with agent policy write access to manipulate administrative actions, resulting in unauthorized resource deletion.A path traversal vulnerability exists in the Kibana Fleet feature, tracked as CVE-2026-115294. A user with low-privileged access to modify Fleet agent policies can manipulate resource paths. When an administrator subsequently interacts with the affected Fleet interface, these manipulated paths can result in the deletion of unauthorized resources, such as Kibana spaces and other organizational assets.

Impact

Successful exploitation allows low-privileged users to bypass access controls and trigger the unauthorized deletion of resources they are not otherwise authorized to modify or delete.

Recommendation

  1. Inventory all instances of Kibana where the Fleet feature is enabled.
  2. Review and restrict access to Fleet agent policy management to only essential administrative roles until a security update is applied.
  3. Monitor administrative logs for unexpected deletion of Kibana spaces or management assets initiated by low-privileged user contexts.
  4. Apply the forthcoming patch from Elastic once released to address the path traversal (CWE-22) in the Fleet feature.
]]>highadvisorypath-traversalcve-2026-115294elastic-kibanavulnerabilityweb-applicationsecurity-advisory