CVE-2026-72657 in Fleet Server
Summary
by MITRE • 08/13/2026
Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables (CAPEC-77). The authorization decision for artifact downloads relied on a client-supplied value that was persisted without being validated against the server-side record of the requesting agent's assignment. An authenticated party in possession of a valid enrolled agent credential could therefore retrieve a policy the agent is not assigned to.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability represents a critical authorization bypass flaw classified as CWE-639, which specifically addresses authorization bypass through user-controlled keys. The issue manifests within Fleet Server's artifact download mechanism where the system fails to properly validate client-supplied values against server-side agent assignments. This fundamental security gap allows authenticated users with valid enrolled agent credentials to manipulate variables and access resources they should not be authorized to retrieve. The flaw operates by relying on a client-controlled parameter that persists throughout the authorization decision process without proper server-side validation, creating an exploitable condition where malicious actors can bypass intended access controls.
The technical implementation of this vulnerability exploits the trust placed in client-supplied data during the artifact download authorization phase. When an agent requests access to specific artifacts, the system should verify that the requesting agent is properly assigned to the requested policy or resource. However, the current implementation accepts a user-controlled key value that directly influences the authorization decision without cross-referencing against the server's authoritative records of agent assignments. This creates a scenario where an attacker can manipulate their client-side parameters to obtain access to artifacts associated with different agents or policies they should not legitimately access.
The operational impact of this vulnerability extends beyond simple information disclosure, as it fundamentally undermines the integrity of Fleet Server's access control mechanisms. An authenticated party with valid credentials can potentially access sensitive policy configurations, software artifacts, or other resources that belong to different agents within the fleet. This unauthorized access could lead to exposure of confidential configuration data, potential escalation to other system components, or the ability to manipulate agent behavior through access to unauthorized policies. The vulnerability affects the core authorization logic and could compromise the security posture of entire fleets managed by Fleet Server.
Mitigation strategies should focus on implementing robust server-side validation mechanisms that enforce strict correlation between client requests and server-side agent records. Organizations must ensure that all client-supplied keys or parameters used in authorization decisions undergo comprehensive validation against authoritative server data before granting access. This includes implementing proper input sanitization, establishing clear boundaries between client-controlled and server-controlled values, and ensuring that authorization decisions are based on verified server-side state rather than potentially manipulated client inputs. The solution aligns with ATT&CK technique T1078.004 which addresses valid accounts and emphasizes the importance of validating access controls against authoritative sources.
Security implementations should also consider implementing additional layers of validation including timestamp checks, request integrity verification, and comprehensive audit logging to detect unauthorized access attempts. Regular security testing should include validation of authorization mechanisms against both legitimate and malicious client inputs to ensure that the system properly enforces access controls. This vulnerability highlights the critical need for defense in depth approaches where client-supplied data cannot be trusted for authorization decisions without proper server-side validation, a principle that aligns with core security framework recommendations such as those found in NIST SP 800-53 and ISO 27001 standards.