CVE-2026-72676: Improper Control of Generation of Code in Fleet Server Leading to Code Injection
Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later placed into a server-side script that Fleet Server builds as part of routine agent policy processing, so script syntax embedded in the identifier became part of the script that was executed rather than being treated as data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72676?
The severity of CVE-2026-72676 is medium, with a CVSS score of 6.5.
How do I fix CVE-2026-72676?
Fixing CVE-2026-72676 involves updating to the latest version of Fleet Server that has addressed the code injection vulnerability.
What is the impact of CVE-2026-72676?
CVE-2026-72676 can allow an attacker to execute attacker-supplied script content due to improper control of output configuration identifiers.
What software is affected by CVE-2026-72676?
CVE-2026-72676 affects Fleet Server and Kibana specifically.
What type of vulnerability is CVE-2026-72676?
CVE-2026-72676 is classified as a code injection vulnerability, specifically CWE-94.