---
id: CVE-2026-72676
title: >-
  Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet
  Server can lead to the execution of attacker-supplied script content via Code
  Injection (CAPEC-242)
summary: >-
  Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet
  Server can lead to the execution of attacker-supplied script content via Code
  Injection (CAPEC-242). Kibana accepted an identifier for an output
  configuration wi…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-94
vendor: elastic
product: kibana
affected:
  - 'kibana >= 8.5.0, < 8.19.20'
  - 'kibana >= 9.0.0, < 9.4.5'
  - kibana = 9.5.0
patched:
  - kibana 9.4.5
published: '2026-08-13'
updated: '2026-09-04'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72676'
references:
  - url: >-
      https://discuss.elastic.co/t/fleet-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-93/389510
    label: security@elastic.co
tags:
  - nvd
epss: 0.00548
epssPercentile: 0.43434
ingestedAt: '2026-09-05T18:43:14.535Z'
---

## Overview

Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later placed into a server-side script that Fleet Server builds as part of routine agent policy processing, so script syntax embedded in the identifier became part of the script that was executed rather than being treated as data.

## Affected

- `kibana >= 8.5.0, < 8.19.20`
- `kibana >= 9.0.0, < 9.4.5`
- `kibana = 9.5.0`

## Remediation

Upgrade past the affected range:

- `kibana 9.4.5`