CVE-2026-72677
- Source
- https://cve.org/CVERecord?id=CVE-2026-72677
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72677.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-72677
- Aliases
- Downstream
- Published
- 2026-08-13T19:11:28Z
- Modified
- 2026-09-04T08:06:31Z
- Severity
-
- 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H CVSS Calculator
- Summary
- Relative Path Traversal in Kibana Fleet Leading to Unauthorized Deletion of Users and Other Resources
- Details
-
Relative Path Traversal (CWE-23) in Kibana can lead to the unauthorized deletion of Kibana resources via Relative Path Traversal (CAPEC-139). Kibana Fleet accepted a user-supplied identifier for a Fleet Server host configuration without rejecting relative traversal sequences. The identifier is stored as provided and is later incorporated into the request that Kibana issues when that configuration is removed.
- Database specific
{ "cna_assigner": "elastic", "cwe_ids": [ "CWE-23" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72677.json", "unresolved_ranges": [ { "extracted_events": [ { "introduced": "8.0.0" }, { "last_affected": "8.19.16" }, { "introduced": "9.0.0" }, { "last_affected": "9.3.5" }, { "introduced": "9.4.0" }, { "last_affected": "9.4.2" } ], "source": "AFFECTED_FIELD" } ] }- References
Affected packages
Git / github.com/elastic/elasticsearch
Affected ranges
- Type
- GIT
- Repo
- https://github.com/elastic/elasticsearch
- Events
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "8.0.0" }, { "fixed": "8.19.17" }, { "introduced": "9.0.0" }, { "fixed": "9.3.6" }, { "introduced": "9.4.0" }, { "fixed": "9.4.3" } ], "source": "CPE_RANGE" }
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72677.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "29441788254395633515098764324401556637",
"length": 129
},
"id": "CVE-2026-72677-08cd97ae",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/1f1ab65304a7633cd6511a1fa2b65c914064e724",
"target": {
"file": "x-pack/plugin/ml/src/main/java/org/elasticsearch/xpack/ml/action/TransportInferTrainedModelDeploymentAction.java",
"function": "sendResponse"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "40397406528957796250670637991145046939",
"length": 1215
},
"id": "CVE-2026-72677-12a7e5d0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/1f1ab65304a7633cd6511a1fa2b65c914064e724",
"target": {
"file": "x-pack/plugin/inference/qa/inference-service-tests/src/javaRestTest/java/org/elasticsearch/xpack/inference/DefaultEndPointsIT.java",
"function": "testMultipleInferencesTriggeringDownloadAndDeploy"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"41841651195592930148736172086999723057",
"293921697622875590993476152838503875226",
"201880235236449890862874291613591026267",
"6931030598426457207818976607922096200"
],
"threshold": 0.9
},
"id": "CVE-2026-72677-9497d348",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/1f1ab65304a7633cd6511a1fa2b65c914064e724",
"target": {
"file": "x-pack/plugin/ml/src/main/java/org/elasticsearch/xpack/ml/action/TransportInferTrainedModelDeploymentAction.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "111700266056805079076925351035754336236",
"length": 617
},
"id": "CVE-2026-72677-c905e504",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/1f1ab65304a7633cd6511a1fa2b65c914064e724",
"target": {
"file": "x-pack/plugin/ml/src/main/java/org/elasticsearch/xpack/ml/action/TransportInferTrainedModelDeploymentAction.java",
"function": "orderedListener"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "241575066176641808023110688533211015903",
"length": 304
},
"id": "CVE-2026-72677-d0d4b7fe",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/1f1ab65304a7633cd6511a1fa2b65c914064e724",
"target": {
"file": "x-pack/plugin/inference/qa/inference-service-tests/src/javaRestTest/java/org/elasticsearch/xpack/inference/DefaultEndPointsIT.java",
"function": "isTransientMlInferenceIndexError"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"330219953685486924298274755298237131959",
"166130015368858971406942022203579193789",
"337783925376695354837115980903317907964",
"150307750804902916410080975624959271234",
"153686128340309626383324163697449261191",
"102390998186244914873872092038171582988",
"245399238348785213885479398615378861075",
"117288393288463401964532166318938367911",
"214417864609834662678204278855561442218",
"245186405744128472060288516088896897897",
"193955595797424284137841368521614573857",
"9647211314265521622759035767770903218",
"243344772398150740875004430653142675275",
"83851240527543313267635888024470475211",
"78688963017947431333142322875487224392",
"168491302531714645767248205696815253686",
"125236309399044997400000281087699158995",
"132990391482460805336000105640402572742",
"291348162790534244772418497244911726327",
"132486071438518517437423506955922898453",
"80619291182477827634854396748823757331",
"33159264791753487181784553336347152862",
"153991559771436669268470682107481448841",
"191167260007516084674438259537540611494",
"239146445380549411566847675773548075115",
"14521978852238339045381558265113290694",
"178376481549476433071831563883359506428",
"116339813896664306671512025576166697825",
"229146779753699802054265479874943240634",
"46396995878082220991355606291219984101",
"167806518901712329362075522321398192931",
"28524417813964392607409780957224371900",
"10001939122652558884071231692076084665",
"311660342762049221221006871122406265296",
"105605360463024014740596183169296519056",
"248006774222241606148249795085412743613",
"273828121698775569320936307150012678626",
"146526953548968729068794463901905005369",
"309740307253372276004399670213634983671",
"232140615438285489033187652382509802494"
],
"threshold": 0.9
},
"id": "CVE-2026-72677-df7c16bd",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/1f1ab65304a7633cd6511a1fa2b65c914064e724",
"target": {
"file": "x-pack/plugin/inference/qa/inference-service-tests/src/javaRestTest/java/org/elasticsearch/xpack/inference/DefaultEndPointsIT.java"
}
}
]
vanir_signatures_modified
"2026-09-04T08:06:31Z"
Git / github.com/elastic/kibana
Affected ranges
- Type
- GIT
- Repo
- https://github.com/elastic/kibana
- Events
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "8.0.0" }, { "fixed": "8.19.17" }, { "introduced": "9.0.0" }, { "fixed": "9.3.6" }, { "introduced": "9.4.0" }, { "fixed": "9.4.3" } ], "source": "CPE_RANGE" }