CVE-2026-72676
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Fleet Server has a code injection vulnerability (CWE-94) that can lead to execution of attacker-supplied script content. Kibana accepts an identifier for an output configuration without restricting safe characters. The identifier is later placed into a server-side script, so embedded script syntax becomes part of the executed script.
Risk Assessment
An attacker could execute arbitrary code on the Fleet Server, potentially leading to full system compromise. This requires authentication and appropriate privileges.
Recommendation
Update Kibana and Fleet Server to patched versions. Restrict permissions for output configurations and validate identifiers.
Original NVD description (English source)
Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later placed into a server-side script that Fleet Server builds as part of routine agent policy processing, so script syntax embedded in the identifier became part of the script that was executed rather than being treated as data.