CVE-2026-72677

Name of the Vulnerable Software and Affected Versions Kibana (affected versions not specified)

Description Kibana Fleet allows a user-supplied identifier for a Fleet Server host configuration to be accepted without rejecting relative traversal sequences. This identifier is stored and subsequently used in requests issued by Kibana during the removal of that configuration, which can lead to the unauthorized deletion of Kibana resources through Relative Path Traversal, a technique used to access files or directories outside the intended folder by using special characters like dot-dot-slash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.