CVE-2026-72657: fallo de gravedad media en Elastic Fleet Server
Authorization Bypass Through User-Controlled Key in Fleet Server Leading to Information Disclosure
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.5epss 0.4%
Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables (CAPEC-77). The authorization decision for artifact downloads relied on a client-supplied value that was persisted without being validated against the server-side record of the requesting agent's assignment. An authenticated party in possession of a valid enrolled agent credential could therefore retrieve a policy the agent is not assigned to.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Productos afectados
Elastic · Fleet ServerCVEs relacionadas — Elastic Fleet Server
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-46667HIGHFleet Server Insertion of Sensitive Information into Log FileEPSS 0.7%CVE-2026-72676MEDIUMImproper Control of Generation of Code in Fleet Server Leading to Code InjectionEPSS 0.5%CVE-2026-56150MEDIUMAllocation of Resources Without Limits or Throttling in Fleet Server Leading to Denial of ServiceEPSS 0.5%CVE-2023-31421MEDIUMBeats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issueEPSS 0.3%CVE-2026-78587LOWIncorrect Authorization in Fleet Server Leading to Denial of Service of Agent Upload OperationsEPSS 0.3%CVE-2024-52975CRITICALFleet Server sensitive information exposure via logsEPSS 0.3%