CVE-2026-78587
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122). Fleet Server does not correctly verify session ownership during multi-part data upload operations, allowing any authenticated agent to interfere with the active upload sessions belonging to other enrolled agents.
Risk Assessment
Risk of disruption of agent operations and data uploads, potentially leading to unavailability of monitoring services.
Recommendation
Update Fleet Server to a version with security fixes and ensure session ownership verification is properly implemented.
Other vulnerabilities in Fleet Server
See all- CVE-2026-72676Medium
Fleet Server has a code injection vulnerability (CWE-94) that can lead to execution of attacker-supplied script content. Kibana accepts an identifier for an output configuration without restricting safe characters. The identifier is later placed into a server-side script, so embedded script syntax becomes part of the executed script.
- CVE-2026-72657Medium
Authorization bypass through user-controlled key in Fleet Server can lead to information disclosure. The authorization decision for artifact downloads relied on a client-supplied value that was not validated against the server-side record of the agent's assignment. An authenticated party with valid agent credentials could retrieve a policy the agent is not assigned to.
- CVE-2026-56150Medium
A CWE-770 vulnerability in Fleet Server allows an attacker to send a specially crafted request to an upload endpoint, causing excessive memory consumption and potentially leading to a denial of service (DoS).
Original NVD description (English source)
Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122). Fleet Server does not correctly verify session ownership during multi-part data upload operations, allowing any authenticated agent to interfere with the active upload sessions belonging to other enrolled agents.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS