CVE-2026-72676
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Fleet Server has a code injection vulnerability (CWE-94) that can lead to execution of attacker-supplied script content. Kibana accepts an identifier for an output configuration without restricting safe characters. The identifier is later placed into a server-side script, so embedded script syntax becomes part of the executed script.
Risk Assessment
An attacker could execute arbitrary code on the Fleet Server, potentially leading to full system compromise. This requires authentication and appropriate privileges.
Recommendation
Update Kibana and Fleet Server to patched versions. Restrict permissions for output configurations and validate identifiers.
Other vulnerabilities in Fleet Server
See all- CVE-2026-78587Low
Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122). Fleet Server does not correctly verify session ownership during multi-part data upload operations, allowing any authenticated agent to interfere with the active upload sessions belonging to other enrolled agents.
- CVE-2026-72657Medium
Authorization bypass through user-controlled key in Fleet Server can lead to information disclosure. The authorization decision for artifact downloads relied on a client-supplied value that was not validated against the server-side record of the agent's assignment. An authenticated party with valid agent credentials could retrieve a policy the agent is not assigned to.
- CVE-2026-56150Medium
A CWE-770 vulnerability in Fleet Server allows an attacker to send a specially crafted request to an upload endpoint, causing excessive memory consumption and potentially leading to a denial of service (DoS).
Original NVD description (English source)
Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later placed into a server-side script that Fleet Server builds as part of routine agent policy processing, so script syntax embedded in the identifier became part of the script that was executed rather than being treated as data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS