Read the docs
TI-2021-15699 Aliases CVE-2021-37941GHSA-r562-m862-63w3

Improper privilege management in Elastic APM Java Agent

Priority LOW 33CWE-269Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-269.

Summary

A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious file to an application running with the APM Java agent. Using this vector, a malicious or compromised user account could use the agent to run commands at a higher level of permissions than they possess. This vulnerability affects users that have set up the agent via the attacher cli 3, the attach API 2, as well as users that have enabled the profiling_inferred_spans_enabled option

Why it matters now

EPSS 0.00214 11th percentileScored 2026-11-07
Fix Fixed elastic-apm (PyPI): 1.27.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ElasticAPM Java Agent1.10.0 through 1.26.0—No fix listedCNA
—elastic-apm (PyPI)1.10.0 to before 1.27.01.27.0Patch availableGHSA-r562-m862-63w3
  • APM Java Agent VendorElastic Affected 1.10.0 through 1.26.0 Fixed in — No fix listed CNA
  • elastic-apm (PyPI) Vendor— Affected 1.10.0 to before 1.27.0 Fixed in 1.27.0 Patch available GHSA-r562-m862-63w3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:elastic:apm_agent:*:*:*:*:*:java:*:*1.10.0 – 1.26.0VulnerableElastic
  • cpe:2.3:a:elastic:apm_agent:*:*:*:*:*:java:*:* Versions 1.10.0 – 1.26.0 Vulnerable ·Elastic

Remediation

  • Fix · GHSA-r562-m862-63w3 elastic-apm (PyPI) Fixed in 1.27.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-37941
  2. 2026-10-03 Alias added: GHSA-r562-m862-63w3

References

Advisory 2

Other 1

  • TI-2019-05371 Improper input validation in Elastic APM agent for Python CVSS 3.0HIGH 7.2
  • TI-2021-05123 Sensitive information in log files in Elastic APM Agent for Go CVSS 3.1LOW 2.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences