Live › vulnerability › CVE-2026-115289
APM Server, Elastic's application performance monitoring server, can be made to hand an authenticated agent the central configuration that belongs to a different service, until the cache expires. A service can then run with sampling settings meant for another service, which is an information disclosure and a configuration mix-up.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
No product ranges from the sources yet.
apm-server version or the version field on its root endpoint, and compare it against the fixed release in the product ranges.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a specially crafted agent configuration request. An authenticated APM agent could receive the central agent configuration that belongs to a different service until the cached configuration expires. A service could also run with central configuration settings, such as sampling settings, that were meant for a different service.
This page as .md · .json · in your agent: get_signal("CVE-2026-115289")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.