CVE-2026-72657

Received Received - Intake

Authorization Bypass in Fleet Server via User-Controlled Key

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description

Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables (CAPEC-77). The authorization decision for artifact downloads relied on a client-supplied value that was persisted without being validated against the server-side record of the requesting agent's assignment. An authenticated party in possession of a valid enrolled agent credential could therefore retrieve a policy the agent is not assigned to.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-72657

EUVD

EUVD-2026-58280

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	fleet_server	*
elastic	fleet_server	From 8.3.0 (inc) to 8.19.19 (inc)
elastic	fleet_server	From 9.0.0 (inc) to 9.4.4 (inc)
elastic	fleet_server	9.5.0
elastic	fleet_server	8.19.20
elastic	fleet_server	9.4.5
elastic	fleet_server	9.5.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-72657 is an authorization bypass vulnerability in Fleet Server where an authenticated attacker with valid enrolled agent credentials can manipulate a client-supplied key to retrieve policies assigned to other agents. This occurs because the server does not validate the client-supplied value against the server-side record of the agent's assignment.

Detection Guidance

To detect this vulnerability, check if your Fleet Server version is within the affected range (8.3.0-8.19.19, 9.0.0-9.4.4, or 9.5.0). Use commands like 'curl -X GET http://<fleet-server>/api/version' to verify the version. Monitor logs for unauthorized policy retrieval attempts by agents.

Impact Analysis

This vulnerability allows an attacker to access sensitive information by downloading policies assigned to other agents. It could lead to unauthorized data exposure if an attacker exploits the flaw to retrieve confidential policies they are not permitted to access.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA by enabling unauthorized access to sensitive information. Such breaches may result in legal penalties, loss of trust, and failure to meet regulatory requirements for data confidentiality and integrity.

Mitigation Strategies

Upgrade Fleet Server to versions 8.19.20, 9.4.5, or 9.5.1 immediately. If upgrading is not possible, isolate the Fleet Server from untrusted networks and restrict agent enrollment to trusted sources.

Hi! I’m here to help you understand CVE-2026-72657. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70