CVE-2026-78587: Incorrect Authorization in Fleet Server Leading to Denial of Service of Agent Upload Operations
Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122). Fleet Server does not correctly verify session ownership during multi-part data upload operations, allowing any authenticated agent to interfere with the active upload sessions belonging to other enrolled agents.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be an authenticated, enrolled Fleet agent. The issue allows one enrolled agent to interfere with active multi-part upload sessions belonging to other enrolled agents.
What is the operational impact?
The documented impact is denial of service affecting agent upload operations. The provided severity vector indicates no confidentiality or integrity impact, with availability impact limited to low.
Are unauthenticated or purely remote attackers affected by this requirement?
No. Although the attack vector is network-based, exploitation requires low-level privileges in the form of authenticated agent access; no user interaction is required.