CVE-2026-56150: medium-severity vulnerability in Elastic Fleet Server
Allocation of Resources Without Limits or Throttling in Fleet Server Leading to Denial of Service
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.5%
Allocation of Resources Without Limits or Throttling (CWE-770) in Fleet Server can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacker can submit a specially crafted request to an upload endpoint that causes excessive memory consumption, which may render Fleet Server unavailable.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
Elastic · Fleet ServerRelated CVEs — Elastic Fleet Server
In the same product, most dangerous first.
CVE-2023-46667HIGHFleet Server Insertion of Sensitive Information into Log FileEPSS 0.7%CVE-2026-72676MEDIUMImproper Control of Generation of Code in Fleet Server Leading to Code InjectionEPSS 0.5%CVE-2026-72657MEDIUMAuthorization Bypass Through User-Controlled Key in Fleet Server Leading to Information DisclosureEPSS 0.4%CVE-2023-31421MEDIUMBeats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issueEPSS 0.3%CVE-2026-78587LOWIncorrect Authorization in Fleet Server Leading to Denial of Service of Agent Upload OperationsEPSS 0.3%CVE-2024-52975CRITICALFleet Server sensitive information exposure via logsEPSS 0.3%