Live › vulnerability › CVE-2026-115294
A path traversal flaw in Kibana's Fleet feature lets a user with Fleet agent policy write access make a later administrative action act on unintended resources. An attacker can get Kibana spaces and other organizational assets deleted that they could not delete directly.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
Teams that run self-hosted Kibana with Fleet enabled and have users with Fleet agent policies write access. The sources say exploitation requires an administrator to interact with the affected Fleet interface, so instances without Fleet in use are less exposed.
No product ranges from the sources yet.
kibana --version or the package manifest and compare it to the fixed versions in the vendor advisory.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in the Kibana Fleet feature can lead to unauthorized resource deletion via Path Traversal (CAPEC-126). A low-privileged user with Fleet agent policies write access could cause a subsequent administrative action to act on unintended resources. This can result in the deletion of resources such as Kibana spaces and other organizational assets that the low-privileged user cannot delete directly. Exploitation requires an administrator to interact with the affected Fleet interface.
This page as .md · .json · in your agent: get_signal("CVE-2026-115294")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.