OPA15: Elastic APM Server Unintended Config Exposure via Duplicate IDs
CVE-2026-115289 Published on November 3, 2026
Use of Multiple Resources with Duplicate Identifier in APM Server Leading to Information Disclosure
Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a specially crafted agent configuration request. An authenticated APM agent could receive the central agent configuration that belongs to a different service until the cached configuration expires. A service could also run with central configuration settings, such as sampling settings, that were meant for a different service.
Vulnerability Analysis
CVE-2026-115289 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Weakness Type
Use of Multiple Resources with Duplicate Identifier
The software uses multiple resources that can have the same identifier, in a context in which unique identifiers are required. If the software assumes that each resource has a unique identifier, the software could operate on the wrong resource if attackers can cause multiple resources to be associated with the same identifier.
Products Associated with CVE-2026-115289
Want to know whenever a new CVE is published for Elastic Apm Server? stack.watch will email you.
Affected Versions
Elastic APM Server:- Version 8.0.0, <= 8.19.23 is affected.
- Version 9.0.0, <= 9.4.8 is affected.
- Version 9.5.0, <= 9.5.5 is affected.