Sensitive information in log files in Elastic APM Agent for Go
Priority LOW 13CWE-532Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 1 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-532.
Summary
The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application panic it is possible the headers will not be sanitized before being sent.
Why it matters now
EPSS 0.00528 44th percentileScored 2026-11-07
Fix Partial Elastic APM Agent for Go (Elastic): 1.11.0go.elastic.co/apm (Go): 1.11.0Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Elastic | Elastic APM Agent for Go | before 1.11.0 | 1.11.0 | Patch available | CNA |
| — | go.elastic.co/apm (Go) | before 1.11.0 | 1.11.0 | Patch available | GHSA-qqc5-rgcc-cjqh |
- Elastic APM Agent for Go VendorElastic Affected before 1.11.0 Fixed in 1.11.0 Patch available CNA
- go.elastic.co/apm (Go) Vendor— Affected before 1.11.0 Fixed in 1.11.0 Patch available GHSA-qqc5-rgcc-cjqh
Remediation
- Fix · CNA Elastic APM Agent for Go (Elastic) Fixed in 1.11.0
- Fix · GHSA-qqc5-rgcc-cjqh go.elastic.co/apm (Go) Fixed in 1.11.0 Advisory →
Red Hat 1 advisory
- RHSA-2021:2438 Released 2021-07-27 · Red Hat rating ModerateOpenShift Container Platform 4.8.2 bug fix and security update
- Red Hat OpenShift Container Platform 4.8 openshift4/driver-toolkit-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenStack Platform 16.2 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4.8 | Fixed | RHSA-2021:2438 |
Not affected: 6 products
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.8
- Red Hat OpenShift Virtualization 2
- Red Hat OpenShift Virtualization 4
- Red Hat Openshift Container Storage 4
Timeline
- 2026-10-02 Threatist record created from CVE-2021-22133
- 2026-10-03 Alias added: GHSA-qqc5-rgcc-cjqh
References
Advisory 2
Other 6
- https://github.com/elastic/apm-agent-go/pull/888
- https://github.com/elastic/apm-agent-go/commit/c5c7e21aa26a6def7790f74fbceed792ad47ef35
- https://github.com/elastic/apm-agent-go/commit/dd3e8c593580e7b80a98b57e1cc6e017e56747b4
- https://github.com/elastic/apm-agent-go
- https://github.com/elastic/apm-agent-go/compare/v1.10.0...v1.11.0
- https://pkg.go.dev/vuln/GO-2022-0706
More Elastic Apm Agent vulnerabilities
- TI-2019-05371 Improper input validation in Elastic APM agent for Python CVSS 3.0HIGH 7.2
- TI-2021-15699 Improper privilege management in Elastic APM Java Agent CVSS 3.1HIGH 7.8
Sources
- CVE-2021-22133 · CVE Program
- CVE-2021-22133 · NVD
- FIRST EPSS
- GHSA-qqc5-rgcc-cjqh · GitHub Advisory Database · CC BY 4.0
- CVE-2021-22133 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences