Description
Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later placed into a server-side script that Fleet Server builds as part of routine agent policy processing, so script syntax embedded in the identifier became part of the script that was executed rather than being treated as data.
Published: 2026-08-13
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Fleet Server is vulnerable to code injection (CWE‑94) because Kibana accepts an output‑configuration identifier without sanitizing it. The identifier is later embedded into a server‑side script that Fleet Server builds during routine agent‑policy processing, allowing an attacker’s script content to be executed as code rather than treated as data. This flaw can be used to run arbitrary code with the privileges of the Fleet Server process, potentially compromising data confidentiality, integrity, and availability on the affected host.

Affected Systems

Elastic Fleet Server is affected. The vulnerability exists in versions prior to the security update referenced in the discussion thread (Fleet Server 8.19.20, 9.4.5, and 9.5.1). Systems running earlier or unpatched releases of the product should be considered vulnerable.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate level of severity. The exploit requires that an attacker have the ability to create or modify an output‑configuration identifier in Kibana, which may imply authenticated or privileged access. Since no EPSS value is available and the vulnerability is not listed in CISA’s KEV catalog, the likelihood of an immediate, widespread exploitation is currently low, but the potential impact of successful code execution is significant.

Generated by OpenCVE AI on August 13, 2026 at 21:11 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Elastic Fleet Server to the latest patched release (8.19.20, 9.4.5, or 9.5.1).
  • If an upgrade is not immediately possible, sanitize output‑configuration identifiers to allow only safe characters before they are persisted by Kibana.
  • Restrict access to Kibana’s output‑configuration interface so that only trusted, authorized users can create or modify identifiers.
  • Monitor for anomalous script execution or errors in Fleet Server logs and investigate promptly.

Generated by OpenCVE AI on August 13, 2026 at 21:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Elastic
Elastic fleet Server
Vendors & Products Elastic
Elastic fleet Server
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 13 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Description Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later placed into a server-side script that Fleet Server builds as part of routine agent policy processing, so script syntax embedded in the identifier became part of the script that was executed rather than being treated as data.
Title Improper Control of Generation of Code in Fleet Server Leading to Code Injection
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Elastic Fleet Server
cve-icon MITRE

Status: PUBLISHED

Assigner: elastic

Published:

Updated: 2026-08-13T20:32:02.584Z

Reserved: 2026-08-10T11:17:49.704Z

Link: CVE-2026-72676

cve-icon Vulnrichment

Updated: 2026-08-13T20:31:59.047Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-13T20:17:28.257

Modified: 2026-08-28T15:32:26.217

Link: CVE-2026-72676

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T21:15:03Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')