The vulnerability is a Use of Multiple Resources with Duplicate Identifier (CWE-694) in Elastic APM Server. An authenticated agent can send a specially crafted configuration request and receive the central configuration data that belongs to a different service until the cached configuration expires. This allows an attacker to learn configuration information such as sampling settings that were intended for another service and can lead to misconfiguration of the victim service. The weakness arises from insufficient validation of resource identifiers in the server’s configuration handling process.

Elastic APM Server. All instances of the product that allow authenticated APM agents to request configuration files are potentially impacted. The CVE does not list specific versions, so any deployed instance not yet updated to the fix is vulnerable.

The CVSS score of 4.3 indicates moderate risk. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated APM agent that can construct a specific configuration request. Successful exploitation results in disclosure of configuration details and possible misconfiguration of services, but does not provide arbitrary code execution or broader system compromise.