Code Injection in Fleet Server (Kibana) via Unsafe Output ID
CVE-2026-72676 Published on August 13, 2026
Improper Control of Generation of Code in Fleet Server Leading to Code Injection
Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later placed into a server-side script that Fleet Server builds as part of routine agent policy processing, so script syntax embedded in the identifier became part of the script that was executed rather than being treated as data.
Vulnerability Analysis
CVE-2026-72676 is exploitable with network access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is a Code Injection Vulnerability?
The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVE-2026-72676 has been classified to as a Code Injection vulnerability or weakness.
Affected Versions
Elastic Fleet Server:- Version 8.5.0, <= 8.19.19 is affected.
- Version 9.0.0, <= 9.4.4 is affected.
- Version 9.5.0 is affected.