CVE-2026-72676

Executive Summary

CVE-2026-72676 is a code injection vulnerability (CWE-94, CAPEC-242) affecting Elastic Fleet Server, where Kibana accepts an identifier for an output configuration without restricting it to safe characters. This identifier is later concatenated into a server-side script that Fleet Server constructs as part of routine agent policy processing, allowing attacker-supplied script syntax to be executed rather than treated as data. The vulnerability requires high privileges (PR:H) but is network-exploitable without user interaction, and no patch has been identified — leaving affected Elastic deployments in a state of elevated risk.

Technical Analysis

The vulnerability resides in the interaction between Elastic Kibana and Fleet Server. Fleet Server is a component within the Elastic Stack that manages agent policies, coordinating the communication between Kibana and the Elastic Agents deployed across an enterprise. During routine agent policy processing, Fleet Server constructs server-side scripts that contain configuration identifiers — these scripts are generated dynamically as part of normal operations.

The flaw is rooted in insufficient input validation on the part of Kibana. Specifically, Kibana accepts an identifier used for an output configuration without validating or sanitizing it against a whitelist of safe characters. Output configurations in Fleet are used to direct agents to their designated destinations (e.g., Elasticsearch clusters or Logstash endpoints), and each configuration is referenced by a unique identifier.

The lifecycle of the attack is as follows:

1. Input Acceptance: An authenticated user with high privileges submits an output configuration identifier through Kibana's interface (API or UI). Kibana fails to validate that the identifier consists solely of safe characters (alphanumeric, hyphens, underscores, etc.).

2. Server-Side Script Construction: During agent policy processing, Fleet Server incorporates this identifier into a dynamically generated script. The identifier is placed into the script through string concatenation or template interpolation — the exact code construction is not disclosed in the NVD description.

3. Code Injection: Because the identifier is not treated as opaque data but rather embedded directly into the script source, any script syntax included in the identifier (e.g., command separators, function calls, or statement terminators) becomes part of the executed script. The injected content is interpreted as code rather than as a static string value.

4. Execution: When the script is executed (on Fleet Server or as part of the agent policy distribution pipeline), the injected script content runs with the privileges of the Fleet Server process.

This is a classic code injection vulnerability (CAPEC-242) that stems from the failure to enforce a "safe characters only" policy on an input that later flows into a code-generation context. The CWE-94 classification indicates that the vulnerability is specifically about improper control of code generation — the system generates code (server-side scripts) and fails to sanitize inputs before embedding them.

The attack surface is limited to authenticated users with high privileges (CVSS PR:H), which suggests that administrative access to Kibana is required. This is a meaningful constraint: the threat model is not about remote unauthenticated attackers, but rather about compromised or malicious administrators, or about privilege escalation scenarios where a lower-privileged actor gains access to administrative functions.

The CVSS vector also indicates a network attack vector (AV:N) with low attack complexity (AC:L), meaning the attack can be carried out remotely without special conditions. The impact is rated as high for both confidentiality (C:H) and integrity (I:H), but there is no availability impact (A:N). This suggests that a successful exploit can lead to full data exfiltration (high confidentiality impact — reading arbitrary data accessible to Fleet Server) and data manipulation (high integrity impact — writing or modifying data, potentially including other agent configurations or policies), but not denial-of-service.

Note that no specific affected version ranges have been disclosed, and the CVE data does not include information about whether a patch exists or whether the vulnerability has been exploited in the wild. The patch confidence score of 0/4 indicates that no patch evidence has been found from any tracked source.

Exploitation Scenarios

The NVD description provides the following attack chain details, and where specifics are unavailable, the attack is described at the vulnerability-class level.

Prerequisites

• Authentication: The attacker must be authenticated to Kibana with high privileges (CVSS PR:H).
• Access: Network access to the Kibana/Fleet Server infrastructure (CVSS AV:N).
• Knowledge: Understanding of Fleet Server's agent policy processing and output configuration structure.

Attack Chain Steps

Step 1 — Reconnaissance and Target Identification

The attacker identifies an Elastic Stack deployment that uses Fleet Server for agent management. This may involve scanning for exposed Kibana web interfaces (typically on port 5601) and enumerating Fleet-related REST API endpoints (the NVD description does not provide specific endpoint paths). The attacker confirms they have (or can obtain) administrative credentials with the necessary privileges to create or modify output configurations.

Step 2 — Triggering the Vulnerable Code Path

The attacker authenticates to Kibana and navigates to the Fleet → Settings → Outputs section (UI) or uses the corresponding Fleet API (exact API paths not disclosed in the NVD description). They craft a request to create or update an output configuration where the identifier (the output_id or equivalent — exact parameter name not disclosed) contains script syntax.

For example (conceptual, not verbatim from NVD), the identifier might include characters such as:

%s; injected_payload()

or

$(malicious_command)

The key point is that the identifier string includes characters and syntax that would be valid in a scripting language (e.g., JavaScript, Python, or shell) rather than being restricted to safe alphanumeric/hyphen/underscore characters.

Step 3 — Payload Execution

When Fleet Server processes agent policies and constructs the server-side script, it embeds the malicious identifier directly into the script source. The injected script syntax is interpreted as part of the code. This could result in:

• Execution of arbitrary commands via command injection (if the script is a shell script or similar).
• Execution of arbitrary code via code injection (if the script is a scripting language like Python or JavaScript).
• Manipulation of other script parameters or execution flow.

Step 4 — Post-Exploitation Impact

Given the CVSS ratings of C:H and I:H, the attacker can:

• Data Exfiltration: Read any data or environment variables accessible to the Fleet Server process, potentially including agent policy configurations, secrets, API keys, or credentials stored in Fleet Server's configuration.
• Data Manipulation: Modify Fleet configuration, inject additional malicious policies, or alter the behavior of agent management.
• Lateral Movement Potential: Use compromised Fleet Server credentials or access to pivot into other parts of the Elastic Stack or connected infrastructure.

No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description's mechanism of "script syntax embedded in the identifier became part of the script that was executed."

Impact Assessment

Business Impact:

The business impact of CVE-2026-72676 is significant for any organization relying on Elastic's Fleet Server for centralized agent management. Fleet Server is a critical control-plane component — it orchestrates policy distribution to potentially thousands of Elastic Agents. Compromise of Fleet Server could allow an attacker to:

1. Exfiltrate sensitive configuration data: Agent policies often contain non-secret but sensitive infrastructure details (target hosts, security configurations, etc.) and could potentially expose credentials or API keys.

2. Manipulate agent policies: An attacker with the ability to inject code into Fleet Server scripts could alter the behavior of agents fleet-wide, potentially redirecting data to attacker-controlled endpoints, disabling security monitoring, or injecting malicious configurations.

3. Impersonate the legitimate Fleet Server: If the attacker can extract secrets or keys from the server-side script environment, they may be able to impersonate Fleet Server or its communications.

Affected Systems:

• All Elastic deployments using Fleet Server for agent policy management (exact version ranges not disclosed).
• Systems exposed to the network where Kibana/Fleet is accessible.
• Due to the CVE data not including an affected version list, the scope of impacted versions is unknown.

Blast Radius:

The CVSS score of 6.5 (Medium severity) reflects the high privilege requirement (PR:H) as a mitigating factor. However, the absence of a patch and the network-exploitable nature elevate the real-world urgency. The confidentiality and integrity impacts are both rated "High," meaning the total loss of confidentiality and integrity is possible. There is no availability impact, so the system remains operational, which may reduce detection likelihood.

CVSS Subscore Rationale:

• AV:N — Attack is remotely exploitable over the network.
• AC:L — No special conditions are required; the attack is straightforward once the identifier is submitted.
• PR:H — Attacker needs high privileges (administrative access to Kibana/Fleet), which limits the attacker population.
• UI:N — No user interaction required for exploitation.
• S:U — The compromise does not extend beyond the Fleet Server component (scope unchanged).
• C:H / I:H — Full confidentiality and integrity loss possible.
• A:N — No availability impact.

Detection Guidance

The following detection mechanisms aim to identify both the vulnerable configuration creation/update and the resulting unusual script execution or network behavior. Since no known exploit signatures exist, these rules focus on anomalous identifier inputs and unexpected server-side script activity.

Sigma Rule

title: Kibana Fleet Output Identifier Code Injection
id: 5d9447d0-a1b2-4c3e-8f9a-0f1e2d3c4b5a
status: experimental
description: >
  Detects creation or modification of Fleet output configurations with
  identifiers containing script syntax or unsafe characters, indicative of
  CVE-2026-72676 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-72676
author: Valtersit Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026.72676
logsource:
  category: application
  product: kibana
  service: fleet
detection:
  selection:
    event.action:
      - output_create
      - output_update
      - fleet_output_config
    request.body.output_id|re::
      - ".+[;|&><{}\\[\\]`$()].*"
      - ".+\\s+.*"
      - ".+[^a-zA-Z0-9_\\-].*"
  condition: selection
falsepositives:
  - Legitimate output identifiers that include unusual but safe characters
level: high

YARA Rule

rule CVE_2026_72676_Fleet_Output_ID_Injection {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects Fleet Server output identifiers containing script syntax in Kibana/Fleet logs"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-72676"
        date = "2026-01-01"
    strings:
        $script_delim_1 = ");"
        $script_delim_2 = ";"
        $script_delim_3 = "{\n"
        $script_delim_4 = "}"
        $script_delim_5 = "`"
        $script_delim_6 = "$("
        $script_delim_7 = "&&"
        $script_delim_8 = "|"
        $script_delim_9 = "<%"
        $script_delim_10 = "%>"
        $func_pattern_1 = /(function|def|var|let|const|echo|print|exec|run|eval|system|shell|os\.)\s*\(/ ascii nocase
        $endpoint_pattern = /output[_\-]?id\s*[:=]\s*["'][^"']*[;|&<>\{\}\[\]\(\)`\$]/ ascii nocase
    condition:
        uint16(0) == 0x0A0D or uint16(0) == 0x0D0A or
        any of ($script_delim_*) and any of ($func_pattern_*) or
        $endpoint_pattern
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-72676 Kibana Fleet Output Identifier Injection Attempt"; flow:to_server,established; content:"/api/fleet"; http.uri; content:"output"; http.uri; content:"id"; http.uri; pcre:"/(output_id|outputId|id)[\"']?\s*[:=]\s*[\"'][^\"']*[;|&<>\{\}\[\]\(\)`\$]/i"; classtype:attempted-admin; sid:2026072676; rev:1; reference:cve,2026-72676; priority:1;)

Elastic Detection

// EQL query for Elastic Cloud / Elastic Security detection
// Detects Fleet server output configuration events with suspicious identifiers
sequence by host.name
  with maxspan=5m
  [network where process.name == "fleet-server" and
   event.category == "network" and
   network.protocol == "http"]
  [file where process.name == "fleet-server" and
   event.action in ("create", "update") and
   file.path like~ "*fleet*output*" and
   // Look for script syntax in written content
   file.texture: ("**;*", "**{*}", "**(*", "**$(*", "**`*")]

Splunk SPL Query

index=* sourcetype=kibana* OR sourcetype=fleet*
| where like(output_id, "%;%") OR like(output_id, "%|%") OR 
        like(output_id, "%<%") OR like(output_id, "%>%") OR
        like(output_id, "%{") OR like(output_id, "%}") OR
        like(output_id, "%(%") OR like(output_id, "%)%") OR
        like(output_id, "%`%") OR like(output_id, "%$%")
| eval malicious_input = if(match(output_id, "[^a-zA-Z0-9_\-]"), "SUSPICIOUS", "NORMAL")
| where malicious_input == "SUSPICIOUS"
| table _time, host, source, event_type, output_id, output_name, user
| sort - _time

Wazuh OSSEC Rule

<group name="elastic,cve-2026-72676,">
  <rule id="100376" level="12" frequency="5" timeframe="300">
    <if_sid>92000</if_sid>
    <regex>output[_\-]?id\s*[:=]\s*["'][^"']*[;|&<>\{\}\[\]\(\)`\$]</regex>
    <description>Possible CVE-2026-72676 Code Injection in Kibana Fleet Server output configuration</description>
    <group>cve-2026-72676,elastic_fleet,code_execution,</group>
    <mitre>
      <id>T1190</id>
      <description>Exploit Public-Facing Application</description>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: No patch is available. Patch confidence is 0/4 from all tracked sources, meaning the vulnerability remains unpatchable as of the report date. The NVD entry does not reference a vendor advisory or fix version.

1. Immediate Mitigations

Since no patch exists, the following interim measures should be implemented:

• Restrict Access to Kibana and Fleet Server: Limit network access to Kibana and Fleet Server to only authorized administrative endpoints. Use VPNs, network segmentation, or firewall rules to reduce the attack surface.
• Enforce Strong Authentication (MFA): Require multi-factor authentication for all Kibana administrative accounts. Since exploitation requires high privileges (PR:H), reducing the likelihood of credential compromise mitigates the primary attack vector.
• Audit Output Configuration Changes: Implement manual review of all output configuration creations and modifications. Restrict permissions such that only a small set of trusted administrators can perform these actions.
• Apply Zero-Trust Principles: Assume the Fleet Server may be compromised; segment it from critical infrastructure and sensitive data stores.
• Monitor for Suspicious Identifiers: Deploy the detection rules above to alert on any output configuration identifier that contains characters outside the safe set ([a-zA-Z0-9_-]).
• Disable or Remove Unnecessary Output Configurations: If output configurations are not actively used, remove or disable them to reduce the attack surface.
• Temporary WAF Rule: If a web application firewall is in place, add a rule to block HTTP requests to Kibana's Fleet API that contain special characters (; | & < > { } [ ] ` $ ( ) ) in output ID parameters.

2. Patch/Upgrade Steps

As no patch is currently available, monitor the following sources for updates:

• Elastic Security Advisories: Monitor Elastic's official security advisory pages for announcements related to CVE-2026-72676.
• NVD and CVE Databases: Watch for updates to the CVE entry that may disclose affected versions and fix versions.
• Elastic Release Notes: Track new releases of Kibana and Fleet Server patches; upgrade as soon as a fix is published.
• OSV and Vulnerability Feeds: Subscribe to OSV.dev and other vulnerability feeds for real-time notifications.

3. Long-Term Hardening

• Input Validation Best Practices: Implement strict input validation on all Kibana Fleet API calls, including output configuration identifiers. Apply a whitelist of allowed characters (e.g., [a-zA-Z0-9_-]) to all identifiers.
• Least Privilege Principle: Ensure that only a minimal set of administrative accounts have permissions to create or modify output configurations.
• Runtime Application Self-Protection (RASP): Consider deploying RASP solutions that can detect and block code injection attempts at runtime.
• Regular Security Audits: Conduct routine penetration testing of Elastic Stack deployments, focusing on Fleet Server configurations and the input validation paths.
• Vendor Engagement: Contact Elastic support or submit a request for a custom patch if the vulnerability poses an urgent risk to your environment.
• Monitoring & Logging: Enhance logging on Fleet Server to capture all script execution events, output configuration changes, and any unusual process activity. Retain logs for incident response.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72676
2. Elastic Security Advisories: https://discuss.elastic.co/c/security-announcements/ (monitor for the CVE-2026-72676 advisory when published)
3. CWE-94 Code Injection: https://cwe.mitre.org/data/definitions/94.html
4. CAPEC-242 Code Injection: https://capec.mitre.org/data/definitions/242.html
5. Fleet Server Documentation: https://www.elastic.co/guide/en/fleet/current/fleet-server.html

Threat Actor Campaigns / Exploitation in the Wild: No evidence of exploitation in the wild has been reported as of the writing of this report. The vulnerability is not on the CISA KEV (Known Exploited Vulnerabilities) list. No public PoC or exploit code has been released. However, given the absence of a patch, the probability of exploitation increases as the vulnerability becomes more widely known. Security teams should treat this as a high-priority unpatched vulnerability and implement detection and mitigation measures accordingly.