Information Disclosure Due to Resource Mismanagement in APM Server by Elastic
CVE-2026-115289

4.3MEDIUM

Key Information:

Vendor

Elastic
Status
Apm Server
Vendor
CVE Published:
3 November 2026

What is CVE-2026-115289?

The APM Server by Elastic is susceptible to a vulnerability that results from the use of multiple resources with duplicate identifiers. This flaw allows an authenticated APM agent to access sensitive configuration data intended for different services via a specially crafted agent configuration request. Until the cached configurations expire, configurations from one service may inadvertently provide access to another service's central configuration settings, including critical sampling settings and more.

Affected Version(s)

APM Server 8.0.0 <= 8.19.23

APM Server 9.0.0 <= 9.4.8

APM Server 9.5.0 <= 9.5.5

References

https://discuss.elastic.co/t/apm-server-8-19-24-9-4-9-9-5...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.