Read the docs
TI-2023-25171 Aliases CVE-2023-46669GHSA-xr86-xwvg-mq5q

Elastic Agent / Elastic Endpoint Security local API key disclosure

Priority LOW 31CWE-200Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

Exposure of sensitive information to local unauthorized actors in Elastic Agent and Elastic Security Endpoint can lead to loss of confidentiality and impersonation of Endpoint to the Elastic Stack. This issue was identified by Elastic engineers and Elastic has no indication that it is known or has been exploited by malicious actors.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00197 9th percentileScored 2026-11-07
Fix Fixed Elastic Agent and Elastic Defend (Elastic): 8.15.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ElasticElastic Agent and Elastic Defend8.0.0 to before 8.15.08.15.0Patch availableCNA
  • Elastic Agent and Elastic Defend VendorElastic Affected 8.0.0 to before 8.15.0 Fixed in 8.15.0 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:elastic:elastic_agent:*:*:*:*:*:*:*:*before 8.15.0VulnerableElastic
cpe:2.3:a:elastic:endpoint_security:*:*:*:*:*:*:*:*before 8.15.0VulnerableElastic
  • cpe:2.3:a:elastic:elastic_agent:*:*:*:*:*:*:*:* Versions before 8.15.0 Vulnerable ·Elastic
  • cpe:2.3:a:elastic:endpoint_security:*:*:*:*:*:*:*:* Versions before 8.15.0 Vulnerable ·Elastic

Remediation

  • Fix · CNA Elastic Agent and Elastic Defend (Elastic) Fixed in 8.15.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-46669
  2. 2026-10-03 Alias added: GHSA-xr86-xwvg-mq5q

References

Patch 1

  • TI-2026-54653 Incorrect Permission Assignment for Critical Resource in Elastic Agent Leading to Local Privilege Escalation to SYSTEM CVSS 3.1HIGH 7.8
  • TI-2024-35456 Elastic Agent Inclusion of Functionality from Untrusted Control Sphere CVSS 3.1HIGH 7.8
  • TI-2023-15038 Beats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issue CVSS 3.1HIGH 7.5
  • TI-2023-06115 Elastic Agent Insertion of Sensitive Information into Log File CVSS 3.1MEDIUM 6.8
  • TI-2024-24798 Elastic Agent Insertion of Sensitive Information into Log File CVSS 4.0MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences