CVE-2026-115289: Elastic APM Server: config mixup leaks other services' settings

MEDIUM

Published November 3, 2026

CISO Take

Elastic APM Server has a duplicate-identifier flaw (CWE-694) in its central agent configuration cache. An authenticated APM agent can receive another service's configuration until the cache expires, and a service may even run with sampling settings meant for a different one. This is a medium-severity issue (CVSS 4.3) that needs valid agent credentials. It is not in CISA KEV, has no public exploit or Nuclei template, and no EPSS score is published, so exploitation pressure is low. The practical risk is limited information disclosure and misconfigured observability, for example sampling rates that hide traces for sensitive AI services. Upgrade to APM Server 8.19.24, 9.4.9 or 9.5.6 as described in Elastic advisory ESA-2026-200, and prioritize multi-tenant or shared-APM deployments.

Sources:NVDElastic discuss forum (ESA-2026-200)ATLAS

What is the risk?

Low to medium. The attack is network-reachable with low complexity and needs low privileges (a valid APM agent credential) and no user interaction. Confidentiality impact is low and there is no integrity or availability impact in the CVSS vector. There is no KEV listing, no public exploit and no scanner template. Exposure is highest where one APM Server serves many teams or tenants with separate central configuration per service. Elastic APM is general observability tooling, not an AI/ML component, so the AI-specific risk is indirect.

How does the attack unfold?

Initial Access

The attacker obtains or uses a valid APM agent credential for any service connected to the shared APM Server.

AML.T0012

Exploitation

The attacker sends a crafted agent configuration request that triggers the duplicate-identifier collision in the config cache.

AML.T0049

Collection

The server returns the central configuration belonging to a different service, including sampling and tuning settings.

AML.T0036

Impact

Another service may run with wrong settings, reducing telemetry coverage and exposing internal configuration details.

Initial Access

The attacker obtains or uses a valid APM agent credential for any service connected to the shared APM Server.

AML.T0012

Exploitation

The attacker sends a crafted agent configuration request that triggers the duplicate-identifier collision in the config cache.

AML.T0049

Collection

The server returns the central configuration belonging to a different service, including sampling and tuning settings.

AML.T0036

Impact

Another service may run with wrong settings, reducing telemetry coverage and exposing internal configuration details.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CLow

INone

ANone

What should I do?

1 step

1) Upgrade APM Server to 8.19.24, 9.4.9 or 9.5.6 (or later) per ESA-2026-200. 2) Until patched, limit central agent configuration to the services that need it and avoid sharing one APM Server across trust boundaries. 3) Rotate and scope APM agent API keys or secret tokens, and use distinct credentials per service. 4) Audit the configuration that each service is actually running, especially sampling settings for critical or AI-facing services. 5) Monitor APM Server logs for unusual agent configuration requests from unexpected agents or services.

How is it classified?

Data LeakageAuth BypassFrameworkAPIAML.T0012- Valid Accounts AML.T0036- Data from Information Repositories

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and mechanisms for supersession

Frequently Asked Questions

What is CVE-2026-115289?

Is CVE-2026-115289 actively exploited?

No confirmed active exploitation of CVE-2026-115289 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-115289?

1) Upgrade APM Server to 8.19.24, 9.4.9 or 9.5.6 (or later) per ESA-2026-200. 2) Until patched, limit central agent configuration to the services that need it and avoid sharing one APM Server across trust boundaries. 3) Rotate and scope APM agent API keys or secret tokens, and use distinct credentials per service. 4) Audit the configuration that each service is actually running, especially sampling settings for critical or AI-facing services. 5) Monitor APM Server logs for unusual agent configuration requests from unexpected agents or services.

What systems are affected by CVE-2026-115289?

This vulnerability affects the following AI/ML architecture patterns: observability pipelines, model serving, agent frameworks, multi-tenant monitoring.

What is the CVSS score for CVE-2026-115289?

CVE-2026-115289 has a CVSS v3.1 base score of 4.3 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

observability pipelinesmodel servingagent frameworksmulti-tenant monitoring

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0036Data from Information Repositories

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a specially crafted agent configuration request. An authenticated APM agent could receive the central agent configuration that belongs to a different service until the cached configuration expires. A service could also run with central configuration settings, such as sampling settings, that were meant for a different service.

Exploitation Scenario

An attacker or malicious insider holds a valid APM agent credential, for example one taken from a low-value service in a shared environment. They send crafted agent configuration requests to the APM Server that trigger the duplicate-identifier collision. The server returns the cached central configuration of another service, such as an LLM inference gateway, exposing its sampling and tuning settings. The same collision can also make a monitored AI service run with settings meant for a different service, degrading its telemetry coverage and so masking later malicious activity.

Weaknesses (CWE)

CWE-694Use of Multiple Resources with Duplicate Identifier CWE-694Use of Multiple Resources with Duplicate Identifier

CWE-694 — Use of Multiple Resources with Duplicate Identifier: The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.

[Architecture and Design] Where possible, use unique identifiers. If non-unique identifiers are detected, then do not operate any resource with a non-unique identifier and report the error appropriately.

Source: MITRE CWE corpus.