# CVE-2026-115289: Elastic APM Server configuration cache collision information disclosure

Source: https://junglewise.ai/threats/cve-2026-115289-use-of-multiple-resources-with-duplicate-identifier-cwe-694-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-115289 · Severity: medium · CVSS 4.3 · Published 2026-11-03

Elastic APM Server, which collects and processes application performance data, contains a flaw in how it caches agent configuration settings. An authenticated APM agent could receive configuration intended for a different service, exposing sensitive configuration details like sampling rates and other settings. This could allow one service to operate with another service's configuration or see another service's configuration data.

Technologies: [Elastic Apm Server](https://junglewise.ai/threats/technologies/apm-server). Vendors: [Elastic](https://junglewise.ai/threats/vendors/elastic).

## Quick answers

**Is CVE-2026-115289 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115289 being exploited in the wild.

**How severe is CVE-2026-115289?** Medium severity, with a CVSS score of 4.3, published 3 November 2026.

**Which products and versions are affected?** Elastic Apm Server 8.0.0 through 8.19.23, 9.0.0 through 9.4.8, 9.5.0 through 9.5.5.

**Is there a fix for CVE-2026-115289?** Yes: fixed in APM Server 8.19.24, 9.4.9, 9.5.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115289 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-115289?** Check whether you run Elastic Apm Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in APM Server 8.19.24, 9.4.9, 9.5.6

## Technical details

A use-of-multiple-resources-with-duplicate-identifier flaw (CWE-694) in APM Server's central agent configuration handling allows cache collisions when retrieving configuration through Kibana. An authenticated APM agent can receive cached configuration belonging to a different service until the cache expires. The vulnerability requires APM agent authentication and central configuration to be enabled; the attacker gains visibility into configuration of other services or causes services to run with mismatched configuration.

## Affected products

- Elastic APM Server 8.0.0 through 8.19.23, 9.0.0 through 9.4.8, 9.5.0 through 9.5.5

## Timeline

- 2026-11-03: disclosed

## References

- [https://discuss.elastic.co/t/apm-server-8-19-24-9-4-9-9-5-6-security-update-esa-2026-200/391355](https://discuss.elastic.co/t/apm-server-8-19-24-9-4-9-9-5-6-security-update-esa-2026-200/391355)

## Related threats

- [Elastic APM Server denial of service via oversized OTLP payloads](https://junglewise.ai/threats/cve-2026-115716-allocation-of-resources-without-limits-or-throttling-cwe-770-in)
- [Elastic Docker images certificate validation flaw in OS bundle](https://junglewise.ai/threats/cve-2026-115714-improper-certificate-validation-cwe-295-in-the-operating-system)
- [Elastic APM Server improper handling of compressed data denial of service](https://junglewise.ai/threats/cve-2026-78594-elastic-apm-server-improper-handling-of-compressed-data-denial-of)