Read the docs
TI-2023-06115 Aliases CVE-2023-6687GHSA-xqc7-q7jr-cg3w

Elastic Agent Insertion of Sensitive Information into Log File

Priority LOW 31CWE-532Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-532.

Summary

An issue was discovered by Elastic whereby Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to Elasticsearch failed with any 4xx HTTP status code except 409 or 429. Depending on the nature of the event that Elastic Agent attempted to ingest, this could lead to the insertion of sensitive or private information in the Elastic Agent logs. Elastic has released 8.11.3 and 7.17.16 that prevents this issue by limiting these types of logs to DEBUG level logging, which is disabled by default.

Why it matters now

EPSS 0.00589 48th percentileScored 2026-11-07
Fix Fixed Elastic Agent (Elastic): 7.17.16, 8.11.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ElasticElastic Agent7.0.0, 8.0.0 to before 7.17.16, 8.11.37.17.16, 8.11.3Patch availableCNA
  • Elastic Agent VendorElastic Affected 7.0.0, 8.0.0 to before 7.17.16, 8.11.3 Fixed in 7.17.16, 8.11.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:elastic:elastic_agent:*:*:*:*:*:*:*:*7.0.0 to before 7.17.16; 8.0.0 to before 8.11.3VulnerableElastic
  • cpe:2.3:a:elastic:elastic_agent:*:*:*:*:*:*:*:* Versions 7.0.0 to before 7.17.16; 8.0.0 to before 8.11.3 Vulnerable ·Elastic

Remediation

  • Fix · CNA Elastic Agent (Elastic) Fixed in 7.17.16, 8.11.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-6687
  2. 2026-10-03 Alias added: GHSA-xqc7-q7jr-cg3w

References

Advisory 1

  • TI-2026-54653 Incorrect Permission Assignment for Critical Resource in Elastic Agent Leading to Local Privilege Escalation to SYSTEM CVSS 3.1HIGH 7.8
  • TI-2024-35456 Elastic Agent Inclusion of Functionality from Untrusted Control Sphere CVSS 3.1HIGH 7.8
  • TI-2023-15038 Beats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issue CVSS 3.1HIGH 7.5
  • TI-2023-25171 Elastic Agent / Elastic Endpoint Security local API key disclosure CVSS 3.1HIGH 7.1
  • TI-2024-24798 Elastic Agent Insertion of Sensitive Information into Log File CVSS 4.0MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences