CVE-2026-72657

Executive Summary

CVE-2026-72657 is an authorization bypass vulnerability in Elastic Fleet Server, rooted in an insecure direct object reference pattern (CWE-639) where authorization decisions rely on a client-supplied, user-controlled key. An authenticated threat actor holding a valid enrolled agent credential can exploit this flaw to retrieve a policy the agent is not assigned to, resulting in information disclosure of sensitive policy configuration data. The vulnerability is currently unpatched according to all tracked sources (Patch Confidence 0/4), and no public exploit code or PoC has been identified. With a CVSS score of 6.5 (High confidentiality impact, Low attack complexity, Low privileges required), the primary risk is to organizations relying on Fleet Server to segment agent configurations and enforce least-privilege boundaries.

Technical Analysis

The vulnerability is rooted in a CWE-639: Authorization Bypass Through User-Controlled Key. Elastic Fleet Server is responsible for managing and distributing agent policies to enrolled Elastic Agents. In normal operation, when an agent requests a policy artifact, the server must verify that the agent is assigned to that policy by cross-referencing the request against stored server-side state.

According to the NVD description, the authorization decision for artifact downloads relied on a client-supplied value that was persisted without validation against the server-side record of the requesting agent's assignment. This indicates that Fleet Server accepted a key, identifier, or reference from the client (the agent) during the artifact retrieval flow, and used that value directly as the basis for the authorization check — or passed it into a query without confirming it matched the agent's actual assigned policy.

The flaw is compounded by CAPEC-77: Manipulating User-Controlled Variables. An attacker can manipulate the parameter(s) used to identify the policy artifact — for example, a policy ID, artifact hash, or filename — replacing it with a valid identifier belonging to another policy. Because the server-side authorization fails to validate that this supplied key corresponds to the requesting agent's own assignment, the server processes the request and returns the artifact.

The attack surface is the Fleet Server's HTTP or gRPC API surface, specifically the artifact download endpoint(s) that serve agent policy bundles. The vulnerability does not require prior access to another agent's credentials — only a valid enrolled agent credential, which an attacker would obtain via other means (e.g., credential theft, leaked configuration, or insider access).

Of note: the NVD description does not enumerate specific endpoint paths, parameter names, or function names. Therefore, the exact implementation-level mechanics (such as the precise parameter that is manipulated) are not available from the CVE data. The confidence in the vulnerability class and mechanism, however, is high given CWE-639's well-documented pattern.

Exploitation Scenarios

No public PoC or exploit code exists for this CVE. The following attack chain is inferred from the vulnerability class (CWE-639) and the NVD description, and should be treated as a working hypothesis for detection engineering rather than a confirmed operational chain.

Step 1: Reconnaissance and Target Identification

An attacker who already possesses a valid enrolled agent credential (e.g., an API key, enrollment token, or agent certificate) first identifies the Fleet Server endpoints that handle policy artifact retrieval. This may be done by reviewing default agent configuration files, observing network traffic from a compromised host, or consulting public Elastic documentation describing the artifact download flow.

Step 2: Triggering the Authorization Flaw

The attacker initiates a request to download a policy artifact. In a properly secured implementation, the server would check that the policy ID in the request matches the policy assigned to the authenticated agent's identity. Due to CWE-639, the server instead trusts the client-supplied key. The attacker modifies the request to reference a different policy ID or artifact identifier — one that belongs to a more privileged role, a different tenant, or a sensitive environment configuration.

Step 3: Payload / Execution Method

At the vulnerability-class level, this is a parameter manipulation attack (CAPEC-77). The attacker changes the value of the user-controlled key in the download request from its own policy identifier to a target policy identifier. No payload injection is required — the manipulation is purely at the logical/authorization layer. Because the server persists and acts on the supplied value without a server-side assignment check, the request is processed and the artifact is returned.

Step 4: Post-Exploitation Impact

The attacker receives the full policy bundle for a policy they are not assigned to. Elastic Agent policies can contain sensitive data including API keys for integrations, credentials for external systems (e.g., cloud provider keys, database credentials), endpoint configuration details, and network paths. The disclosure of this data (C:H — High confidentiality) has a confidentiality impact of High per the CVSS breakdown, enabling lateral movement, credential reuse, or targeted attacks against the infrastructure the policy references.

Impact Assessment

Business Impact: The confidentiality impact of this CVE is rated High under CVSS 3.1. Fleet policies are configuration blobs that often embed secrets. A successful exploit allows an authenticated attacker to enumerate and retrieve policies outside their authorized scope, causing:

• Credential Disclosure: Policies may contain API keys, tokens, and service account credentials used by agents to communicate with external resources.
• Configuration Intelligence: Leaked policies reveal environment topology, network segments, integration configurations, and security control settings — valuable for reconnaissance and subsequent attacks.
• Trust Boundary Compromise: In multi-tenant Elastic deployments, a policy leak from Tenant A to Tenant B (or between development and production environments) crosses the intended isolation boundary.

Affected Systems: All Elastic Fleet Server deployments. Because no affected version range has been disclosed, all versions currently in production should be treated as potentially vulnerable until Elastic issues a vendor advisory or patch.

Blast Radius: Moderate-to-high. The attack requires authentication (PR:L), so it is not remotely exploitable by unauthenticated attackers. However, agent credentials are frequently stored in plaintext config files on endpoints, making them a realistic target for compromise. The impact is limited to data exposure (no integrity or availability impact), but the leaked data can significantly enable further attacks.

CVSS Subscore Breakdown: AV:N (network accessible) / AC:L (no special conditions) / PR:L (requires any valid agent credential) / UI:N (no user interaction) / S:U (scope unchanged) / C:H (high confidentiality) / I:N (no integrity impact) / A:N (no availability impact).

Detection Guidance

Note: Because no PoC or specific exploit implementation is public, the following detection content is oriented toward the CWE-639 behavior pattern: abnormal policy/artifact download requests that reference policy identifiers inconsistent with the requesting agent's known assignments. Tune filters per your environment's normal traffic baselines.

Sigma Rule

title: Elastic Fleet Server Potential Authorization Bypass via Manipulated Policy Artifact Request
id: 2f8c9d41-7b3e-4a6d-9c10-5ef8a2b6d7c3
status: experimental
description: Detects requests to Fleet Server artifact download endpoints where the requested policy identifier does not match the authenticated agent's assigned policy, indicating possible CWE-639 exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-72657
author: Valtersit Threat Intel
date: 2026/06/14
logsource:
    category: web
    product: elastic
    service: fleet-server
detection:
    selection:
        http.url|contains:
            - '/api/fleet/artifacts'
            - '/api/fleet/agent-policies'
            - '/download'
    filter_normal:
        http.url|contains: '<known-assigned-policy-space>'
    condition: selection and not filter_normal
level: high
falsepositives:
    - Legitimate policy transfers or updates initiated by administrators
    - Fleet Server functionality that legitimately serves cross-policy artifacts

YARA Rule

rule CVE_2026_72657_Fleet_Artifact_Manipulation
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects traffic/log artifacts containing anomalous policy ID references in Fleet artifact download requests"
        cve = "CVE-2026-72657"
        date = "2026-06-14"
        severity = "high"
    strings:
        $s1 = "agent-policies" ascii wide nocase
        $s2 = "artifacts" ascii wide nocase
        $s3 = "policy_id" ascii wide nocase
        $s4 = ".tar.gz" ascii wide nocase
        $s5 = "download" ascii wide nocase
    condition:
        (uint16(0) == 0x5A4D or uint16(0) == 0x4D5A) and
        2 of ($s*) and filesize < 1MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Potential Elastic Fleet Server Authorization Bypass (CVE-2026-72657)"; flow:established,to_server;
    http.uri; content:"/api/fleet/"; nocase; content:"artifact"; nocase; distance:0; within:50;
    http.header; name:"Authorization"; content:"ApiKey"; nocase;
    sid:202672657; rev:1; classtype:attempted-user; priority:1; reference:cve,2026-72657; metadata:created_at 2026_06_14, updated_at 2026_06_14;)

Elastic Detection

sequence by agent.id with maxspan=2m
    [ http where http.url contains ("/api/fleet/artifacts" or "/api/fleet/agent-policies") event.category == "web" ] 
    with maxspan=1m
    [ any where /* Requested policy differs from agent's registered assignment */ true]

Note: The EQL rule above requires enrichment of the agent's assignment state; in production, calculate the discrepancy in a pipeline or use a scripted transformation (e.g., compare the policy ID in the URL to the agent's agent.policy_id field).

Splunk SPL Query

index=webserver sourcetype=access_combined_wcookie
| rex field=uri_path "policy\/(?<requested_policy>[^\/]+)"
| eval mismatch=if(requested_policy != agent_policy_id, 1, 0)
| where mismatch=1
| table _time, src_ip, user, agent_policy_id, requested_policy, uri_path, status
| sort - _time

Where agent_policy_id is populated via lookup or an enrichment field from the Fleet Server's application logs.

Wazuh OSSEC Rule

<group name="elastic,fleet,">
  <rule id="100726" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\./api/fleet/artifacts\.</field>
    <description>Elastic Fleet Server: Possible CVE-2026-72657 Authorization Bypass - policy artifact request with mismatched agent assignment</description>
    <group>web_attack,authorization_bypass,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor advisory, patch, or fixed version has been identified by any tracked source at the time of writing. Organizations cannot rely on a version upgrade to remediate this issue until Elastic publishes a fix.

Immediate Mitigations

1. Restrict network access to Fleet Server. Ensure the artifact download endpoints are not reachable from untrusted networks. Use firewalls/security groups to limit access to known agent subnets only.
2. Rotate and compartmentalize agent credentials. If a compromise is suspected, rotate all agent enrollment tokens and API keys. Avoid sharing a single agent credential across multiple policies or environments.
3. Monitor and alert on anomalous artifact downloads. Implement the detection content above (Sigma/Suricata/SPL) to catch policy downloads that reference a policy ID not assigned to the authenticated agent.
4. Review Fleet Server access logs for signs of prior exploitation — specifically, any download requests referencing policy identifiers outside the requesting agent's assignment.
5. Segment environments. If feasible, deploy separate Fleet Server instances per trust zone (dev, staging, prod) to contain the blast radius of a credential compromise.

Patch / Upgrade Steps

• As of the writing of this report, no patched version exists. This section will be updated when Elastic releases a fixed version or vendor advisory.
• Monitor the Elastic Security Announcements page and Elastic discussion forums for advisory publication.
• When a patch becomes available, upgrade all Fleet Server instances to the fixed version. Given that the flaw involves authorization logic, a fix will likely be a minor or patch release; test in a staging environment before production rollout.

Long-Term Hardening

1. Apply defense-in-depth at the authorization layer. After patching, verify via code review or vendor documentation that authorization decisions are derived exclusively from server-side state (the authenticated agent's assigned policy) — never from client-supplied identifiers.
2. Enable and audit Fleet Server audit logging. Ensure logs capture the authenticated agent identity and the policy ID requested in every artifact download.
3. Implement network micro-segmentation. Place Fleet Server behind an API gateway or service mesh that enforces policy-based access at the network layer.
4. Periodically review agent credential storage. Ensure agent credentials are stored encrypted at rest and not exposed in plaintext configuration files or CI/CD pipelines.
5. Subscribe to Elastic Security advisories to receive early notification of pending fixes and coordinated disclosure timelines.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72657 — Official CVE record containing the CWE-639 classification and CVSS 3.1 scoring.
2. CWE-639 (MITRE): https://cwe.mitre.org/data/definitions/639.html — Authorization Bypass Through User-Controlled Key: the underlying weakness class.
3. CAPEC-77 (MITRE): https://capec.mitre.org/data/definitions/77.html — Manipulating User-Controlled Variables: the attack pattern used to exploit this flaw.
4. Elastic Security Announcements: https://www.elastic.co/security/announcements — Monitor for future vendor advisories and patch releases (no advisory exists as of this report).
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-72657 is NOT listed; no exploitation in the wild at the time of writing.

Threat Actor Activity / Exploit-in-the-Wild: No evidence of exploitation in the wild or of threat actor campaigns targeting this CVE has been identified. No public PoC, exploit code, or Nuclei template exists. This status is subject to change and should be re-evaluated in future intelligence cycles.