CVE-2026-72677
HIGH
NVD
CVSS Score
7.3
Severity
HIGH
Published
Aug 13, 2026
Vendor
unknown
Description
Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored as provided and is later incorporated into the request that Kibana issues when that configuration is removed.