APM Server CVE-2026-115289

Exploitation requires an authenticated APM agent (PR:L) issuing a central agent configuration request to an APM Server that provides central configuration to more than one service - the flaw only manifests where multiple services share the same APM Server configuration source. The disclosure is bounded in time: the agent receives the wrong service's configuration only until the cached configuration expires, making the outcome timing-dependent and non-deterministic rather than reliably attacker-controlled. Limiting factors: authentication is required, a multi-service shared-configuration deployment is needed, and impact is confined to configuration disclosure and mis-applied settings (e.g. sampling) rather than code execution or data modification. The precise trigger of the duplicate-identifier collision is not described in the available sources.

This is a moderate, low-priority issue in practice despite being network-reachable. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) describes a network-accessible flaw requiring low-level privileges (PR:L), with only low confidentiality impact and no integrity or availability impact to the system itself. The vuln.today decision label is 'this_month' - a routine patch cadence, not act_now or emergency - which aligns with the modest score. There is no CISA KEV listing (not confirmed actively exploited), no EPSS score provided in the input, and no public exploit identified at time of analysis - the sole reference is the Elastic vendor advisory (ESA-2026-200), not exploit code. The realistic risk is cross-service information disclosure and configuration bleed between tenants/services sharing one APM Server, not remote code execution or data destruction. One caveat worth flagging for defenders: the CVSS scopes impact as C:L only, but the description notes a service may run with another service's settings (e.g. sampling), which is arguably a low integrity impact not reflected in the official vector - verify tolerance for mis-applied config with Elastic. EPSS is absent, so probabilistic exploitation likelihood could not be weighed.

In an environment where one APM Server serves central configuration to multiple services, an authenticated APM agent sends a central agent configuration request and, due to a duplicate-identifier flaw (CWE-694), receives the cached configuration belonging to a different service until that cache entry expires. The receiving service may then disclose another service's settings or operate under sampling/config values meant for a different service. No public exploit code exists; exploitation depends on timing of the shared configuration cache rather than a crafted memory-corruption primitive.