6.5
Moyenne
CVE-2026-72676 Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of…
Description
Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later placed into a server-side script that Fleet Server builds as part of routine agent policy processing, so script syntax embedded in the identifier became part of the script that was executed rather than being treated as data.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Fleet Server | 9.5.0 | Pas de correctif indiqué |
| Fleet Server 9.0 | 9.0.0 → 9.4.4 | Pas de correctif indiqué |
| Fleet Server 8.5 | 8.5.0 → 8.19.19 | Pas de correctif indiqué |
Autres CVE de Fleet Server
Les 7 CVE de Fleet Server →
CVE-2026-78587
Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via…
3.1
Faible
CVE-2026-72657
Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to information disclosure via…
6.5
Moyenne
CVE-2026-56150
Allocation of Resources Without Limits or Throttling (CWE-770) in Fleet Server can lead to a denial of service via…
6.5
Moyenne
CVE-2024-52975
An issue was identified in Fleet Server where Fleet policies that could contain sensitive information were logged on…
9.0
Critique