CVE-2026-56150
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A CWE-770 vulnerability in Fleet Server allows an attacker to send a specially crafted request to an upload endpoint, causing excessive memory consumption and potentially leading to a denial of service (DoS).
Risk Assessment
The organization risks Fleet Server becoming unavailable, which can prevent agent management and telemetry data collection, resulting in loss of visibility into the IT infrastructure.
Recommendation
Apply the vendor-supplied patch immediately and consider implementing bandwidth throttling and memory limits for upload endpoints.
Other vulnerabilities in Fleet Server
See all- CVE-2026-72676Medium
Fleet Server has a code injection vulnerability (CWE-94) that can lead to execution of attacker-supplied script content. Kibana accepts an identifier for an output configuration without restricting safe characters. The identifier is later placed into a server-side script, so embedded script syntax becomes part of the executed script.
- CVE-2026-72657Medium
Authorization bypass through user-controlled key in Fleet Server can lead to information disclosure. The authorization decision for artifact downloads relied on a client-supplied value that was not validated against the server-side record of the agent's assignment. An authenticated party with valid agent credentials could retrieve a policy the agent is not assigned to.
Original NVD description (English source)
Allocation of Resources Without Limits or Throttling (CWE-770) in Fleet Server can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacker can submit a specially crafted request to an upload endpoint that causes excessive memory consumption, which may render Fleet Server unavailable.