CVE-2026-115289
Received Received - Intake

APM Server Central Configuration Information Disclosure

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: Elastic

Description
Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a specially crafted agent configuration request. An authenticated APM agent could receive the central agent configuration that belongs to a different service until the cached configuration expires. A service could also run with central configuration settings, such as sampling settings, that were meant for a different service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-115289
EUVD
EUVD-2026-116071

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Elastic APM Server 8.0.0
Elastic APM Server 9.0.0
Elastic APM Server 9.5.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-694 The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the use of multiple resources with duplicate identifiers in APM Server, which can lead to information disclosure. An authenticated APM agent could receive central agent configurations meant for a different service until the cached configuration expires. This could expose service-specific settings like sampling configurations.

Detection Guidance

Check APM Server versions for affected releases (8.0.0-8.19.23 or 9.0.0-9.4.8 and 9.5.0-9.5.5). Use commands like 'curl -XGET http://<apm-server>:8200' or 'dpkg -l | grep apm-server' to inspect versions. Monitor logs for unusual agent configuration requests or mismatched service settings.

Impact Analysis

This vulnerability could allow an authenticated attacker to access sensitive configuration data belonging to another service. This might include sampling settings or other service-specific details, potentially leading to unintended data exposure or misconfiguration of services.

Mitigation Strategies

Upgrade APM Server to fixed versions (8.19.24, 9.4.9, or 9.5.6+). Disable central agent configuration retrieval via Kibana if not required. Rotate any exposed service-specific configurations like sampling settings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115289. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...