Description

Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later placed into a server-side script that Fleet Server builds as part of routine agent policy processing, so script syntax embedded in the identifier became part of the script that was executed rather than being treated as data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T20:17:28.257Z",
  "pubdate": "2026-08-13T20:17:28.257Z",
  "executiveSummary": "An Improper Control of Generation of Code vulnerability, categorized as CWE-94, has been identified in Fleet Server. This security flaw enables the execution of arbitrary attacker-supplied script content via Code Injection (CAPEC-242). The vulnerability arises because Kibana accepts an identifier for an output configuration without performing adequate input validation or restricting it to safe characters.\nThe resulting impact allows malicious actors to execute arbitrary server-side script logic within the context of the Fleet Server environment during routine agent policy processing. This exposes affected systems to severe risks, including potential remote code execution and full compromise of the affected server infrastructure. Attackers capable of manipulating output configuration identifiers can supply specially crafted script syntax designed to break out of data context and execute as active code.\nThe affected product is Fleet Server within Kibana. Mitigation requires ensuring strict input validation and character restrictions on output configuration identifiers to prevent script syntax injection.",
  "technicalDetails": "The vulnerability stems from insufficient input sanitization and validation within Kibana when handling identifiers for output configurations. Specifically, the vulnerable component fails to enforce strict character restrictions on these identifiers, allowing arbitrary strings containing script syntax to be accepted and processed.\nDuring routine agent policy processing, Fleet Server dynamically constructs server-side scripts. As part of this construction routine, the unsanitized output configuration identifier is directly interpolated or placed into the generated script payload. Because the input lacks proper escaping or structural separation, any embedded script syntax within the identifier is treated as executable code rather than static data.\nThe exploitation method involves an attacker supplying a malicious identifier containing specialized syntax designed to manipulate the logic flow of the dynamically built server-side script. When Fleet Server processes the agent policy, the embedded payload executes with the privileges and context of the Fleet Server process. This attack vector allows malicious script content to achieve execution without requiring complex multi-stage exploitation frameworks, leveraging the native script generation mechanism as the delivery and execution vehicle."
}