CVE-2026-72677

Executive Summary

CVE-2026-72677 is a relative path traversal vulnerability (CWE-23) in Kibana, specifically within the Fleet module, where a user-supplied identifier for a Fleet Server host configuration is accepted without validation of relative traversal sequences. A low-privileged authenticated attacker can store a malicious identifier that, upon configuration removal, leads to unauthorized deletion of Kibana resources with high integrity and availability impact. The vulnerability carries a CVSS score of 7.3 (High) and is currently unpatched, with no public exploit code or active exploitation evidence identified at the time of this report.

Technical Analysis

The vulnerability resides in Kibana's Fleet configuration management. The flaw is a Relative Path Traversal (CWE-23) triggered through CAPEC-139 — a technique where relative path sequences such as ../ are embedded within a user-supplied input value.

From the NVD description:

"Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored as provided and is later incorporated into the request that Kibana issues when that configuration is removed."

The vulnerability mechanism involves three distinct stages:

1. Input validation bypass: When a user supplies an identifier for a Fleet Server host configuration, the application fails to reject strings containing relative traversal sequences (e.g., ../, ..\\). This indicates the application either lacks a denylist/allowlist of acceptable characters or fails to normalize input paths before storage.

2. Trusted storage: The identifier is stored as provided, meaning no sanitization is applied at input time. This transforms a validation failure into a persistent state problem — the malicious path component resides within the trusted configuration store.

3. Unsafe path construction at deletion: When the configuration removal process is triggered, the stored identifier is concatenated into a resource path/request without revalidating the content. The traversal sequences cause the constructed path to escape the intended Fleet Server host configuration directory and refer to arbitrary Kibana resource locations. The deletion operation then executes against this attacker-controlled path, resulting in unauthorized removal of Kibana resources.

The attack surface is the Kibana Fleet API or UI endpoints that accept Fleet Server host configuration identifiers from authenticated users with low privileges. The user interaction requirement (UI:R in the CVSS vector) suggests the attack may require a user to trigger the deletion operation, possibly through a crafted link or social engineering vector that causes a legitimate user or automated process to remove the poisoned configuration.

The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H) characterizes the profile as:

• Network-based attack — no special network position required
• Low attack complexity — no exotic conditions needed to trigger the flaw
• Low privileges required — an authenticated low-privileged Fleet user suffices
• User interaction required — the deletion operation must be invoked
• Unchanged scope — the impact stays within the Kibana security boundary
• High integrity impact — unauthorized deletion of resources is achieved
• High availability impact — deletion of resources can render Kibana features or data unusable

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-72677. The attack chain described below is inferred strictly from the vulnerability class (CWE-23/CAPEC-139) and the NVD description.

Step 1: Reconnaissance / Target Identification

The attacker identifies a vulnerable Kibana instance by fingerprinting the application (HTTP responses, landing page, version disclosure). Fleet functionality must be present and accessible to low-privileged users. The attacker enumerates Fleet Server host configuration endpoints to confirm they can submit a new configuration identifier.

Step 2: Triggering the Vulnerability Class

The attacker submits a Fleet Server host configuration with an identifier containing relative traversal sequences. At the class level, this is analogous to providing ../../../../ sequences within the ID field. Because the application lacks traversal-sequence rejection, the malicious identifier is accepted and stored verbatim in the Kibana configuration store.

Step 3: Payload / Execution Method

The payload is the stored traversal-laced identifier itself. No arbitrary command execution is involved — the exploitation relies on the deletion flow. When the attacker triggers the removal of the poisoned Fleet Server host configuration, Kibana constructs a deletion request using the stored identifier. The traversal sequences cause the resulting path to point outside the intended Fleet configuration directory, targeting arbitrary Kibana resources.

Step 4: Post-Exploitation Impact

The deletion operation executes against the attacker-controlled path, removing Kibana resources the attacker does not own. Depending on the resources targeted, impact ranges from:

• Removal of configured dashboards or saved objects (integrity impact)
• Deletion of critical system indices or Fleet-managed assets rendering the stack non-functional (availability impact)
• Potential cascading failures if deleted resources underpin authentication or authorization checks

No data exfiltration is achieved (C: N in the CVSS vector), consistent with the absence of a confidentiality impact component.

Impact Assessment

Business Impact: This vulnerability allows authenticated low-privileged users to delete Kibana resources beyond their authorization scope. Since Kibana typically serves as the primary operational visualization and management interface in an Elastic Stack deployment, unauthorized deletion of Fleet server configurations, dashboards, saved objects, or system resources can cause:

• Operational disruption (AV:A) — critical monitoring and observability data visualization becomes unavailable
• Configuration loss — Fleet-managed agent deployments may lose their server mappings, causing agents to fail or misbehave
• Audit failure — deletion events can remove audit artifacts, undermining compliance requirements

CVSS Subscore Relevance: The High integrity impact (I:H) and High availability impact (A:H) reflect that resource deletion is the core impact. The Low privilege requirement (PR:L) indicates a concerning attack surface — the vulnerability does not require administrator credentials, only a low-privileged account with access to Fleet configuration managers.

Affected Systems: Any Kibana deployment where Fleet is enabled and accessible to users with limited roles. The absence of a listed affected version range constrains scoping — all deployments should be treated as potentially vulnerable until a patch is available.

Blast Radius: Confined to Kibana resources (confidentiality is not impacted), but the deletion capability can mirror the permissions of the process running Kibana, potentially affecting the underlying Elasticsearch data store if Kibana's credentialed access to Elasticsearch permits deletion of system resources.

Detection Guidance

Sigma Rule

title: Kibana Fleet Server Host Config Traversal Identifier
id: 6f8d2e34-9c21-4f5a-b7d3-1e4a9c8b2f56
status: experimental
description: Detects creation of Kibana Fleet Server host configurations containing relative path traversal sequences in the identifier field
author: Valtersit Threat Intelligence
date: 2026/02/15
logsource:
  category: application
  product: kibana
detection:
  selection:
    event.dataset: kibana.audit
    kibana.audit.type: saved_objects
    kibana.audit.outcome: success
  keyword:
    - '*../*'
    - '*..\\*'
    - '*..%2f*'
    - '*..%5c*'
  condition: selection and keyword
falsepositives:
  - Legitimate identifiers containing traversal-like strings (rare)
level: high

YARA Rule

rule CVE_2026_72677_Kibana_Fleet_Traversal
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects requests to Kibana Fleet containing relative path traversal sequences in host configuration identifiers"
        cve = "CVE-2026-72677"
        date = "2026-02-15"
        severity = "high"
    strings:
        $traversal1 = "../" ascii nocase
        $traversal2 = "..\\" ascii nocase
        $traversal3 = "..%2f" ascii nocase
        $traversal4 = "..%5c" ascii nocase
        $fleet_marker = "fleet" ascii nocase
        $host_marker = "host" ascii nocase
        $config_marker = "configuration" ascii nocase
    condition:
        ($traversal1 or $traversal2 or $traversal3 or $traversal4) and
        ($fleet_marker or $host_marker or $config_marker) and
        filesize < 10MB
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"ET EXPLOIT Kibana Fleet Configuration Relative Path Traversal (CVE-2026-72677)";
    flow:established,to_server;
    content:"fleet";
    http_uri;
    content:"host";
    http_uri;
    pcre:"/(?:\.\.\/|\.\.\\|\.\.%2f|\.\.%5c)/Ui";
    sid:2026072601;
    rev:1;
    metadata:attack_target_server, deployment_elastic, tag_exploit, cve CVE-2026-72677;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2026-72677;
    classtype:attempted-admin;
)

Elastic Detection

sequence by host.name with maxspan=5m
  [ any where process.name == "node" and
    (
      wildcard(process.args, "*../*") or
      wildcard(process.args, "*..\\*")
    ) and
    wildcard(process.args, "*fleet*")
  ]
  [ any where process.name == "node" and
    (event.action == "delete" or event.action == "destroy") and
    wildcard(process.args, "*fleet*")
  ]

Splunk SPL Query

(index=kibana OR index=elasticsearch) sourcetype=kibana_audit
| eval is_traversal=if(match(_raw, "\.\.(/|\\)|\.\.(%2f|%5c)"), 1, 0)
| where is_traversal=1
| search "fleet" OR "host" OR "configuration"
| search action=delete OR action=remove OR action=destroy
| table _time, user.name, host, src_ip, url, action, object.type, object.id
| sort - _time

Wazuh OSSEC Rule

<group name="kibana,">
  <rule id="120777" level="12">
    <decoded_as>json</decoded_as>
    <field name="event.dataset">kibana.audit</field>
    <regex>\.\.(/|\\)</regex>
    <match>fleet</match>
    <match>host</match>
    <match>configuration</match>
    <description>CVE-2026-72677: Relative path traversal sequence detected in Kibana Fleet host configuration identifier</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_72677,fleet,path_traversal,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: UNPATCHED — no patch evidence from any tracked source (Patch Confidence 0/4).

1. Immediate Mitigations

• Restrict Fleet access: Apply the principle of least privilege — revoke Fleet configuration creation/deletion permissions from low-trust user roles.
• Network-level filtering: Deploy WAF rules that reject HTTP requests containing URL-encoded traversal sequences (%2e%2e%2f, %2e%2e%5c) targeting Kibana Fleet endpoints.
• Monitor deletion operations: Enable Kibana audit logging and alert on all Fleet configuration deletions; review these events for anomalies.
• Configuration review: Manually audit existing Fleet Server host configurations for identifiers containing traversal sequences and remove any suspicious entries.

2. Patch / Upgrade Steps

• No vendor fix is available at this time. Monitor the vendor advisory channels and the NVD entry for CVE-2026-72677 for patch announcements.
• When a patched version is released, upgrade Kibana immediately. Until then, treat all versions as potentially vulnerable.

3. Long-Term Hardening

• Input validation: Advocate for and implement allowlist-based validation on all user-supplied identifiers in Kibana, rejecting any characters outside a strict safe set ([a-zA-Z0-9_-]).
• Path normalization: Ensure the application normalizes paths after construction — and verifies the result remains within the intended root directory — before executing deletion operations.
• Security architecture: Segregate Fleet configuration management into a dedicated administrative role that requires elevated credentials and additional authentication factors.
• Continuous monitoring: Integrate Kibana audit logs into the SIEM pipeline and implement behavioral detection for unusual configuration deletion patterns.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72677
2. MITRE CWE-23: https://cwe.mitre.org/data/definitions/23.html — Relative Path Traversal
3. CAPEC-139: https://capec.mitre.org/data/definitions/139.html — Relative Path Traversal attack pattern
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-72677 is NOT listed (no evidence of in-the-wild exploitation)
5. Kibana Product Security & Announcements: https://www.elastic.co/guide/en/kibana/current/release-notes.html — monitor for patch release notes

Exploit-in-the-Wild Status: No known threat actor campaigns have been associated with CVE-2026-72677 as of this report. No PoC code is publicly available. The exploitation potential remains theoretical but is reinforced by the ease of the attack mechanism (relative traversal) and the authenticated low-privileged attack vector.