Read the docs
TI-2023-25169 Aliases CVE-2023-46667GHSA-wv9p-64pj-gq2g

Fleet Server Insertion of Sensitive Information into Log File

Priority LOW 38CWE-532Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-532.

Summary

An issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text. These enrolment tokens could allow someone to enrol an agent into an agent policy, and potentially use that to retrieve other secrets in the policy including for Elasticsearch and third-party services. Alternatively a threat actor could potentially enrol agents to the clusters and send arbitrary events to Elasticsearch.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00664 51st percentileScored 2026-11-07
Fix Fixed Fleet Server (Elastic): 8.10.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ElasticFleet Server8.10.0 to before 8.10.38.10.3Patch availableCNA
  • Fleet Server VendorElastic Affected 8.10.0 to before 8.10.3 Fixed in 8.10.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:elastic:fleet_server:*:*:*:*:*:*:*:*8.10.0 to before 8.10.3VulnerableElastic
  • cpe:2.3:a:elastic:fleet_server:*:*:*:*:*:*:*:* Versions 8.10.0 to before 8.10.3 Vulnerable ·Elastic

Remediation

  • Fix · CNA Fleet Server (Elastic) Fixed in 8.10.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-46667
  2. 2026-10-03 Alias added: GHSA-wv9p-64pj-gq2g
  3. 2026-10-11 EPSS moved to the 50th–90th percentile

References

Advisory 1

Other 1

  • TI-2026-40526 Allocation of Resources Without Limits or Throttling in Fleet Server Leading to Denial of Service CVSS 3.1HIGH 7.5
  • TI-2026-50895 Authorization Bypass Through User-Controlled Key in Fleet Server Leading to Information Disclosure CVSS 3.1MEDIUM 6.5
  • TI-2026-54637 Incorrect Authorization in Fleet Server Leading to Denial of Service of Agent Upload Operations CVSS 3.1LOW 3.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences