What is CVE-2026-72677?

CVE-2026-72677 is a high-severity vulnerability in Elastic Kibana, classified under Relative Path Traversal. CVSS score: 7.3/10. Published 2026-08-13.

How severe is CVE-2026-72677?

High severity. CVSS v3 base score is 7.3 out of 10.

Path Traversal in Elastic Kibana

CVE-2026-72677

Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored as provided and is later incorporated into the request that Kibana issues when that configuration is removed.

CVSS v3 metric

CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H.

Affected products

Elastic Kibana — versions 8.0.0, 9.0.0, 9.4.0

Weakness classification (CWE)

CWE-23 — Relative Path Traversal

References

security@elastic.co

Frequently asked questions

What is CVE-2026-72677?: CVE-2026-72677 is a high-severity vulnerability in Elastic Kibana, classified under Relative Path Traversal. CVSS score: 7.3/10. Published 2026-08-13.
How severe is CVE-2026-72677?: High severity. CVSS v3 base score is 7.3 out of 10.