CVE-2026-115289
MediumCVSS 4.3Summary
Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a specially crafted agent configuration request. An authenticated APM agent could receive the central agent configuration that belongs to a different service until the cached configuration expires. A service could also run with central configuration settings, such as sampling settings, that were meant for a different service.
Risk Assessment
An agent may receive another service's configuration, potentially leading to incorrect data collection, information disclosure, or monitoring malfunction. This can disrupt performance and security analysis.
Recommendation
Update APM Server to a version containing the fix. Until updated, monitor agent configurations for unexpected settings.
Other vulnerabilities in APM Server
See all- CVE-2026-115716Medium
APM Server has a CWE-770 (allocation of resources without limits or throttling) vulnerability enabling denial of service via oversized serialized data payloads. An attacker able to send OpenTelemetry (OTLP) data over HTTP can cause memory exhaustion and server termination.
- CVE-2026-78594Medium
Improper handling of highly compressed data in APM Server can lead to persistent denial of service. An authenticated user with write access to source map content could store specially crafted, highly compressed content that exhausts memory when processed, terminating the process. The condition recurs on every restart until the stored content is removed.
Original NVD description (English source)
Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a specially crafted agent configuration request. An authenticated APM agent could receive the central agent configuration that belongs to a different service until the cached configuration expires. A service could also run with central configuration settings, such as sampling settings, that were meant for a different service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS