CVE-2026-56150: Fleet Server DoS Vulnerability

CVE-2026-56150 Overview

CVE-2026-56150 is a denial of service vulnerability in Elastic Fleet Server. The flaw stems from Allocation of Resources Without Limits or Throttling [CWE-770], enabling Excessive Allocation attacks [CAPEC-130]. An authenticated attacker can submit a specially crafted request to an upload endpoint that triggers excessive memory consumption. The resulting resource exhaustion may render Fleet Server unavailable to legitimate agents and administrators.

Elastic addressed the issue in Fleet Server versions 8.19.11, 9.2.5, and 9.3.0 through security advisory ESA-2026-44.

Critical Impact
A low-privileged network attacker can exhaust Fleet Server memory, disrupting agent management and telemetry collection across the fleet.

Affected Products

Elastic Fleet Server versions prior to 8.19.11
Elastic Fleet Server 9.x versions prior to 9.2.5
Elastic Fleet Server 9.3.0 (fixed release)

Discovery Timeline

2026-07-01 - CVE-2026-56150 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-56150

Vulnerability Analysis

Fleet Server is the control plane component that manages Elastic Agents at scale. It exposes upload endpoints used by agents to submit diagnostics and other file payloads. The vulnerability arises because these endpoints do not enforce sufficient limits on the resources allocated when processing incoming requests.

An attacker with valid low-privilege credentials can craft a request that forces the server to allocate memory disproportionate to the request size. Repeated or single-shot exploitation exhausts available memory, causing the process to slow, fail, or crash. Because Fleet Server coordinates policy delivery and enrollment for managed agents, its unavailability disrupts monitoring and response workflows across the environment.

Root Cause

The root cause is the absence of enforced bounds on memory allocation during upload request handling. Without input size caps, streaming boundaries, or throttling on the upload endpoint, the server trusts client-controlled data to drive allocation size. This pattern maps directly to CWE-770, Allocation of Resources Without Limits or Throttling.

Attack Vector

Exploitation requires network access to the Fleet Server API and valid credentials with permission to reach the vulnerable upload endpoint. No user interaction is needed. The attacker sends a specially crafted upload request whose structure causes the server to allocate excessive memory. Confidentiality and integrity are not affected, but availability impact is high.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-56150

Indicators of Compromise

Unexpected memory growth or out-of-memory terminations of the Fleet Server process
Repeated HTTP requests to Fleet Server upload endpoints from a single authenticated identity within a short window
Fleet Server health checks failing while CPU and network utilization remain unremarkable
Elastic Agents reporting loss of contact with Fleet Server during the incident window

Detection Strategies

Monitor Fleet Server resident set size and heap metrics for sudden spikes correlated with upload API traffic
Alert on abnormal request rates or payload characteristics against upload endpoints
Correlate Fleet Server restarts and OOM events with authenticated API activity logs to identify the source identity

Monitoring Recommendations

Ingest Fleet Server access logs and process metrics into a centralized analytics platform for baseline comparison
Track upload endpoint latency and error rate as leading indicators of resource pressure
Review API key and service account usage for Fleet Server to detect unexpected callers

How to Mitigate CVE-2026-56150

Immediate Actions Required

Upgrade Fleet Server to version 8.19.11, 9.2.5, or 9.3.0 as documented in Elastic advisory ESA-2026-44
Audit API keys and service accounts that can reach Fleet Server upload endpoints and revoke any that are unused
Place Fleet Server behind network controls that restrict access to trusted management networks and agent CIDRs

Patch Information

Elastic released fixed builds in Fleet Server 8.19.11, 9.2.5, and 9.3.0. Refer to the Elastic Security Update ESA-2026-44 for release notes and upgrade guidance.

Workarounds

Restrict Fleet Server network exposure to known agent and administrator sources using firewall rules or a reverse proxy
Enforce request size limits and rate limiting on Fleet Server upload endpoints at an upstream proxy or load balancer
Rotate credentials for any identity suspected of unauthorized access to Fleet Server APIs

bash

# Example: enforce upload size and rate limits at an NGINX reverse proxy
# Cap request body size and throttle bursts to upload endpoints
http {
    limit_req_zone $binary_remote_addr zone=fleet_upload:10m rate=5r/s;

    server {
        listen 8220 ssl;
        server_name fleet.example.internal;

        client_max_body_size 25m;

        location /api/fleet/uploads/ {
            limit_req zone=fleet_upload burst=10 nodelay;
            proxy_pass https://fleet-server-backend;
        }
    }
}