CVE-2026-115289
Description
A flaw was found in APM Server. This vulnerability allows an authenticated Application Performance Monitoring (APM) agent to cause information disclosure by sending a specially crafted configuration request. Consequently, an authenticated client can receive and view central configuration settings, such as sampling rules, intended for a different service until the cached configuration expires.
Statement
This vulnerability is rated as Moderate severity because successful exploitation requires valid authenticated credentials as an APM agent and the blast radius is confined to reading another service's central configuration metadata. An attacker cannot execute arbitrary commands, alter telemetry data, or compromise the underlying host system. Additionally, Elastic APM Server is not distributed as a native package in Red Hat Enterprise Linux, significantly reducing exposure across standard Red Hat deployments.
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
If the product assumes that each resource has a unique identifier, the product could operate on the wrong resource if attackers can cause multiple resources to be associated with the same identifier.
Access Control
Technical Impact: Bypass Protection Mechanism
If unique identifiers are assumed when protecting sensitive resources, then duplicate identifiers might allow attackers to bypass the protection.
Other
Technical Impact: Quality Degradation
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
