{"id":"CVE-2026-115289","kind":"vulnerability","aliases":["CVE-2026-115289"],"related":[],"title":"Elastic APM Server: crafted agent config request leaks another service's settings","description":"Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a specially crafted agent configuration request. An authenticated APM agent could receive the central agent configuration that belongs to a different service until the cached configuration expires. A service could also run with central configuration settings, such as sampling settings, that were meant for a different service.","summary":"APM Server, Elastic's application performance monitoring server, can be made to hand an authenticated agent the central configuration that belongs to a different service, until the cache expires. A service can then run with sampling settings meant for another service, which is an information disclosure and a configuration mix-up.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apm-server","elastic-stack","infrastructure","observability"],"not_affected_if":["central-agent-config-unused"],"how_to_check":"- Find the APM Server version with `apm-server version` or the `version` field on its root endpoint, and compare it against the fixed release in the product ranges.\n- Check whether central agent configuration is in use in Kibana under APM > Settings > Agent Configuration.","fix":null,"status":"open","published_at":"2026-11-03T17:17:54+00:00","first_seen_at":"2026-11-03T17:21:54+00:00","triaged_at":"2026-11-03T17:24:40+00:00","updated_at":"2026-11-03T17:24:40+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-03T17:24:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Elastic APM Server: crafted agent config request leaks another service's settings","impact":"low","summary":"APM Server, Elastic's application performance monitoring server, can be made to hand an authenticated agent the central configuration that belongs to a different service, until the cache expires. A service can then run with sampling settings meant for another service, which is an information disclosure and a configuration mix-up.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["apm-server","elastic-stack","observability"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated agent reads another service's central configuration","analyst_note":"Sources give no affected or fixed version ranges; check the NVD entry and Elastic's advisory for versions.","how_to_check":"- Find the APM Server version with `apm-server version` or the `version` field on its root endpoint, and compare it against the fixed release in the product ranges.\n- Check whether central agent configuration is in use in Kibana under APM > Settings > Agent Configuration.","plain_action":"","needs_analyst":true,"not_affected_if":["central-agent-config-unused"],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000648,"input_tokens":4154,"output_tokens":466,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115289':15A,18A '-2026':14A,17A '-694':86C 'agent':5A,42B,99C,105C,110C 'also':126C 'anoth':9A,66B 'apm':2A,20B,27B,88C,104C 'apm-serv':19B 'applic':31B 'authent':41B,103C 'belong':47B,113C 'cach':54B,120C 'central':44B,109C,129C 'config':6A 'configur':45B,75B,100C,111C,121C,130C 'could':106C,125C 'craft':4A,98C 'cve':13A,16A 'cwe':85C 'differ':50B,116C,141C 'disclosur':72B,94C 'duplic':83C 'elast':1A,23B,29B 'elastic-stack':22B 'expir':55B,122C 'hand':39B 'identifi':84C 'inform':71B,93C 'infrastructur':25B 'lead':91C 'leak':8A 'made':37B 'meant':64B,138C 'mix':77B 'mix-up':76B 'monitor':33B 'multipl':80C 'observ':26B 'perform':32B 'receiv':107C 'request':7A,101C 'resourc':81C 'run':60B,127C 'sampl':62B,134C 'server':3A,21B,28B,34B,89C 'servic':10A,51B,57B,67B,117C,124C,142C 'set':12A,63B,131C,135C 'special':97C 'stack':24B 'use':78C 'via':95C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apmserver","elasticstack","infrastructure","medium","observability"],"campaign_type":null,"first_public_at":"2026-11-03T17:17:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security@elastic.co","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115289","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115289","severity":null,"published_at":"2026-11-03T17:17:54+00:00","modified_at":"2026-11-03T17:17:54+00:00","first_seen_at":"2026-11-03T17:21:54+00:00","fetched_at":"2026-11-03T17:21:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}