Improper Control of Generation of Code in Fleet Server Leading to Code Injection
Description:
Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later placed into a server-side script that Fleet Server builds as part of routine agent policy processing, so script syntax embedded in the identifier became part of the script that was executed rather than being treated as data.
Affected Versions:
- All versions from 8.5.0 up to and including 8.19.19
- All versions from 9.0.0 up to and including 9.4.4
- 9.5.0
Affected Configurations:
All configurations are affected.
Solutions and Mitigations:
The issue is resolved in versions 8.19.20, 9.4.5 and 9.5.1
For Users that Cannot Upgrade:
There are no workarounds for this vulnerability.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVE ID: CVE-2026-72676
Problem Type: CWE-94 - Improper Control of Generation of Code ('Code Injection')
Impact: CAPEC-242 - Code Injection