Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.1

An issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text. These enrolment tokens could allow s...

CVE-2023-46667 · published 3 years ago
Summary

An issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text. These enrolment tokens could allow someone to enrol an agent into an agent policy, and potentially use that to retrieve other secrets in th...

What to do
  • Update elastic fleet_server to version 8.10.3 or later.
Affected software
VendorProductAffected versions
elastic fleet_server >= 8.10.0, < 8.10.3
cpe:2.3:a:elastic:fleet_server:*:*:*:*:*:*:*:*
Original advisory text
An issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text. These enrolment tokens could allow s...
An issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text. These enrolment tokens could allow someone to enrol an agent into an agent policy, and potentially use that to retrieve other secrets in the policy including for Elasticsearch and third-party services. Alternatively a threat actor could potentially enrol agents to the clusters and send arbitrary events to Elasticsearch.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-532Insertion of Sensitive Information into Log File
Timeline
Published26 Oct 2023
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2023-46667 · NVD
Track software like this
Free during beta