CVE-2023-46667: Fleet Server Insertion of Sensitive Information into Log File

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-10-26 · updated 2026-06-17
Weakness: CWE-532

Description

An issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text. These enrolment tokens could allow someone to enrol an agent into an agent policy, and potentially use that to retrieve other secrets in the policy including for Elasticsearch and third-party services. Alternatively a threat actor could potentially enrol agents to the clusters and send arbitrary events to Elasticsearch.

Affected products

Elastic Fleet Server: from 8.10.0 before 8.10.3 — fixed in 8.10.3

How to fix

Upgrade to a fixed version: Elastic Fleet Server 8.10.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-46667 or the next vulnerability affects your stack