Fleet Server vulnerabilities

Fleet Server has a code injection vulnerability (CWE-94) that can lead to execution of attacker-supplied script content. Kibana accepts an identifier for an output configuration without restricting safe characters. The identifier is later placed into a server-side script, so embedded script syntax becomes part of the executed script.

Authorization bypass through user-controlled key in Fleet Server can lead to information disclosure. The authorization decision for artifact downloads relied on a client-supplied value that was not validated against the server-side record of the agent's assignment. An authenticated party with valid agent credentials could retrieve a policy the agent is not assigned to.

A CWE-770 vulnerability in Fleet Server allows an attacker to send a specially crafted request to an upload endpoint, causing excessive memory consumption and potentially leading to a denial of service (DoS).