Elastic Fleet Server vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Elastic Fleet Server: 3 record(s), with affected versions and fixes.
cpe:2.3:a:elastic:fleet_server

CVE-2026-78587 Low · 3.1 CWE-863 Sep 2, 2026

Incorrect Authorization in Elastic Fleet Server

Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122). Fleet Server does not correctly verify session ownership during multi-part data upload operations, allowing any authenticated agent to interfere with the active upload sessions belonging to other enrolled agents.

CVE-2026-72657 Medium · 6.5 CWE-639 Aug 13, 2026

Authorization Bypass Through User-Controlled Key (IDOR) in Elastic Fleet Server

Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables (CAPEC-77). The authorization decision for artifact downloads relied on a client-supplied value that was persisted without being validated against the server-side record of the requesting agent's assignment. An authenticated party in possession of a valid enrolled agent credential could therefore retrieve a policy the agent is not assigned to.

CVE-2026-56150 High · 7.5 CWE-770 Jul 1, 2026

Allocation of Resources Without Limits or Throttling in Fleet Server Leading to Denial of Service

Allocation of Resources Without Limits or Throttling (CWE-770) in Fleet Server can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacker can submit a specially crafted request to an upload endpoint that causes excessive memory consumption, which may render Fleet Server unavailable.