CVE-2026-72657: Authorization Bypass Through User-Controlled Key in Fleet Server Leading to Information Disclosure

Published Aug 13, 2026
·
Updated

Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables (CAPEC-77). The authorization decision for artifact downloads relied on a client-supplied value that was persisted without being validated against the server-side record of the requesting agent's assignment. An authenticated party in possession of a valid enrolled agent credential could therefore retrieve a policy the agent is not assigned to.

Affected Software

4 affected components
Fleet Server
Elastic Fleet Server>=8.3.0<8.19.20
Elastic Fleet Server>=9.0.0<9.4.5
Elastic Fleet Server=9.5.0

Event History

Aug 13, 2026
CVE Published
via MITRE·07:13 PM
Data Sourced
via MITRE·07:13 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:17 PM
DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2026-72657?

The severity of CVE-2026-72657 is medium with a score of 6.5.

2

What risk does CVE-2026-72657 pose?

CVE-2026-72657 poses a risk level of 38, indicating a potential for significant impact if exploited.

3

How do I fix CVE-2026-72657?

To fix CVE-2026-72657, ensure proper validation of user-controlled variables in Fleet Server to prevent unauthorized access.

4

What type of vulnerability is CVE-2026-72657?

CVE-2026-72657 is an authorization bypass vulnerability that can lead to information disclosure.

5

What systems are affected by CVE-2026-72657?

CVE-2026-72657 specifically affects the Fleet Server application.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203