Kibana 9.4.9, 9.5.6 Security Update (ESA-2026-205)

Announcements Security Announcements
1

Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Resource Deletion

Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in the Kibana Fleet feature can lead to unauthorized resource deletion via Path Traversal (CAPEC-126). A low-privileged user with Fleet agent policies write access could cause a subsequent administrative action to act on unintended resources. This can result in the deletion of resources such as Kibana spaces and other organizational assets that the low-privileged user cannot delete directly. Exploitation requires an administrator to interact with the affected Fleet interface.

Affected Versions:

  • 9.x:
  • All versions from 9.3.0 up to and including 9.4.8
  • All versions from 9.5.0 up to and including 9.5.5

Users on the 8.x release line are not affected. The affected Fleet functionality was introduced in 9.3.0 and is not present in 8.x or in 9.x versions before 9.3.0.

Affected Configurations:

  • All Kibana deployments in which one or more users have been granted the Fleet agent policies All privilege are affected.

Solutions and Mitigations:

The issue is resolved in versions 9.4.9 and 9.5.6.

The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the known issues for your target version before upgrading.

For Users that Cannot Upgrade:

There are no workarounds for this vulnerability.

Indicators of Compromise (IOC)

No specific indicators of compromise have been identified for this vulnerability.

Elastic Cloud Serverless

Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.

Severity: CVSSv3.1: High ( 7.3 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
CVE ID: CVE-2026-115294
Problem Type: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory
Impact: CAPEC-126 - Path Traversal