CVE-2026-78587 Incorrect Authorization in Fleet Server Leading to Denial of Service of Agent Upload Operations
Authenticated agents can disrupt other agents' upload sessions due to missing session ownership checks, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-78587?
CVE-2026-78587 is a low-severity missing authorization vulnerability in Elastic Fleet Server, published on 2 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122). Fleet Server does not correctly verify session ownership during multi-part data upload operations, allowing any authenticated agent to interfere with the active upload sessions belonging to other enrolled agents.
Weakness: CWE-863
Which versions are affected by CVE-2026-78587?
It affects 1 product.
Products include Elastic Fleet Server.
How do I fix CVE-2026-78587?
No fix has been published for CVE-2026-78587 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-78587 being exploited?
There is no known exploitation of CVE-2026-78587 in the wild and no public exploit code.
Other vulnerabilities in Elastic Fleet Server
- CVE-2023-46667 Fleet Server Insertion of Sensitive Information into Log File
- CVE-2026-72657 Authorization Bypass Through User-Controlled Key in Fleet Server Leading to Information Disclosure
- CVE-2026-56150 Allocation of Resources Without Limits or Throttling in Fleet Server Leading to Denial of Service
Sources
Also known as GHSA-cg8q-4j53-92fq.