CVE-2023-46667 Fleet Server Insertion of Sensitive Information into Log File
Attackers can read enrollment tokens from logs to enroll agents and access sensitive secrets or inject arbitrary events.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-46667?
CVE-2023-46667 is a high-severity vulnerability in Elastic Fleet Server, published on 26 Oct 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text. These enrolment tokens could allow someone to enrol an agent into an agent policy, and potentially use that to retrieve other secrets in the policy including for Elasticsearch and third-party services. Alternatively a threat actor could potentially enrol agents to the clusters and send arbitrary events to Elasticsearch.
Weakness: CWE-532
Which versions are affected by CVE-2023-46667?
It affects 1 product.
Products include Elastic Fleet Server.
How do I fix CVE-2023-46667?
No fix has been published for CVE-2023-46667 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-46667 being exploited?
There is no known exploitation of CVE-2023-46667 in the wild and no public exploit code.
Other vulnerabilities in Elastic Fleet Server
- CVE-2026-72657 Authorization Bypass Through User-Controlled Key in Fleet Server Leading to Information Disclosure
- CVE-2026-56150 Allocation of Resources Without Limits or Throttling in Fleet Server Leading to Denial of Service
- CVE-2026-78587 Incorrect Authorization in Fleet Server Leading to Denial of Service of Agent Upload Operations
Sources
Also known as GHSA-wv9p-64pj-gq2g.