CVE-2026-72657

Name of the Vulnerable Software and Affected Versions Fleet Server (affected versions not specified)

Description An authorization bypass exists where the system relies on a client-supplied value for artifact download decisions without validating it against the server-side record of the requesting agent's assignment. This allows an authenticated party with a valid enrolled agent credential to retrieve policies not assigned to that agent, leading to information disclosure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.