Vulnerabilidades do Elastic Fleet Server

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Elastic Fleet Server: 2 registro(s), com versões afetadas e correções.
cpe:2.3:a:elastic:fleet_server

CVE-2026-72657 Média · 6.5 CWE-639 13/08/2026

Authorization Bypass Through User-Controlled Key (IDOR) em Elastic Fleet Server

Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables (CAPEC-77). The authorization decision for artifact downloads relied on a client-supplied value that was persisted without being validated against the server-side record of the requesting agent's assignment. An authenticated party in possession of a valid enrolled agent credential could therefore retrieve a policy the agent is not assigned to.

CVE-2026-56150 Alta · 7.5 CWE-770 01/07/2026

Allocation of Resources Without Limits or Throttling in Fleet Server Leading to Denial of Service

Allocation of Resources Without Limits or Throttling (CWE-770) in Fleet Server can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacker can submit a specially crafted request to an upload endpoint that causes excessive memory consumption, which may render Fleet Server unavailable.