CVE-2026-115289

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115289", "assignerOrgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a", "state": "PUBLISHED", "assignerShortName": "elastic", "dateReserved": "2026-10-22T09:42:41.198Z", "datePublished": "2026-11-03T16:43:58.518Z", "dateUpdated": "2026-11-03T17:36:41.024Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "APM Server", "vendor": "Elastic", "versions": [{"status": "affected", "versionType": "semver", "version": "8.0.0", "lessThanOrEqual": "8.19.23"}, {"status": "affected", "versionType": "semver", "version": "9.0.0", "lessThanOrEqual": "9.4.8"}, {"status": "affected", "versionType": "semver", "version": "9.5.0", "lessThanOrEqual": "9.5.5"}]}], "descriptions": [{"lang": "en", "value": "Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a specially crafted agent configuration request. An authenticated APM agent could receive the central agent configuration that belongs to a different service until the cached configuration expires. A service could also run with central configuration settings, such as sampling settings, that were meant for a different service.", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a specially crafted agent configuration request. An authenticated APM agent could receive the central agent configuration that belongs to a different service until the cached configuration expires. A service could also run with central configuration settings, such as sampling settings, that were meant for a different service.</p>"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-694", "description": "CWE-694 Use of Multiple Resources with Duplicate Identifier", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a", "shortName": "elastic", "dateUpdated": "2026-11-03T16:43:58.518Z"}, "references": [{"url": "https://discuss.elastic.co/t/apm-server-8-19-24-9-4-9-9-5-6-security-update-esa-2026-200/391355"}], "source": {"discovery": "Elastic"}, "title": "Use of Multiple Resources with Duplicate Identifier in APM Server Leading to Information Disclosure", "x_generator": {"engine": "Elastic CVE Publisher 1.0.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-03T17:36:32.290044Z", "id": "CVE-2026-115289", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T17:36:41.024Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115289", "assignerOrgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a", "state": "PUBLISHED", "assignerShortName": "elastic", "dateReserved": "2026-10-22T09:42:41.198Z", "datePublished": "2026-11-03T16:43:58.518Z", "dateUpdated": "2026-11-03T17:36:41.024Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "APM Server", "vendor": "Elastic", "versions": [{"status": "affected", "versionType": "semver", "version": "8.0.0", "lessThanOrEqual": "8.19.23"}, {"status": "affected", "versionType": "semver", "version": "9.0.0", "lessThanOrEqual": "9.4.8"}, {"status": "affected", "versionType": "semver", "version": "9.5.0", "lessThanOrEqual": "9.5.5"}]}], "descriptions": [{"lang": "en", "value": "Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a specially crafted agent configuration request. An authenticated APM agent could receive the central agent configuration that belongs to a different service until the cached configuration expires. A service could also run with central configuration settings, such as sampling settings, that were meant for a different service.", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a specially crafted agent configuration request. An authenticated APM agent could receive the central agent configuration that belongs to a different service until the cached configuration expires. A service could also run with central configuration settings, such as sampling settings, that were meant for a different service.</p>"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-694", "description": "CWE-694 Use of Multiple Resources with Duplicate Identifier", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a", "shortName": "elastic", "dateUpdated": "2026-11-03T16:43:58.518Z"}, "references": [{"url": "https://discuss.elastic.co/t/apm-server-8-19-24-9-4-9-9-5-6-security-update-esa-2026-200/391355"}], "source": {"discovery": "Elastic"}, "title": "Use of Multiple Resources with Duplicate Identifier in APM Server Leading to Information Disclosure", "x_generator": {"engine": "Elastic CVE Publisher 1.0.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-115289", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-03T17:36:32.290044Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T17:36:37.126Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "APM Server", "vendor": "Elastic", "versions": [{"lessThanOrEqual": "8.19.23", "status": "affected", "version": "8.0.0", "versionType": "semver"}, {"lessThanOrEqual": "9.4.8", "status": "affected", "version": "9.0.0", "versionType": "semver"}, {"lessThanOrEqual": "9.5.5", "status": "affected", "version": "9.5.0", "versionType": "semver"}]}], "source": "security@elastic.co"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a specially crafted agent configuration request. An authenticated APM agent could receive the central agent configuration that belongs to a different service until the cached configuration expires. A service could also run with central configuration settings, such as sampling settings, that were meant for a different service."}], "id": "CVE-2026-115289", "lastModified": "2026-11-03T20:32:50.687", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@elastic.co", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-115289", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-03T17:36:32.290044Z", "version": "2.0.3"}}]}, "published": "2026-11-03T17:17:54.783", "references": [{"source": "security@elastic.co", "url": "https://discuss.elastic.co/t/apm-server-8-19-24-9-4-9-9-5-6-security-update-esa-2026-200/391355"}], "sourceIdentifier": "security@elastic.co", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-694"}], "source": "security@elastic.co", "type": "Secondary"}]}

{"bugzilla": {"description": "apm-server: APM Server: Information disclosure via crafted agent configuration request", "id": "2566034", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2566034"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-694", "details": ["Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a specially crafted agent configuration request. An authenticated APM agent could receive the central agent configuration that belongs to a different service until the cached configuration expires. A service could also run with central configuration settings, such as sampling settings, that were meant for a different service.", "A flaw was found in APM Server. This vulnerability allows an authenticated Application Performance Monitoring (APM) agent to cause information disclosure by sending a specially crafted configuration request. Consequently, an authenticated client can receive and view central configuration settings, such as sampling rules, intended for a different service until the cached configuration expires."], "name": "CVE-2026-115289", "public_date": "2026-11-03T16:43:58Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-115289\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115289\nhttps://discuss.elastic.co/t/apm-server-8-19-24-9-4-9-9-5-6-security-update-esa-2026-200/391355"], "statement": "This vulnerability is rated as Moderate severity because successful exploitation requires valid authenticated credentials as an APM agent and the blast radius is confined to reading another service's central configuration metadata. An attacker cannot execute arbitrary commands, alter telemetry data, or compromise the underlying host system. Additionally, Elastic APM Server is not distributed as a native package in Red Hat Enterprise Linux, significantly reducing exposure across standard Red Hat deployments.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.0.0,8.19.23]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.0.0,9.4.8]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.5.0,9.5.5]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "APM Server", "source": "cna", "vendor": "Elastic"}, "product": "apm_server", "vendor": "elastic"}], "created": "2026-11-03T18:45:14.392922+00:00", "updated": "2026-11-03T19:15:14.388588+00:00", "vendors": ["elastic", "elastic$PRODUCT$apm_server"]}