CVE-2024-52976 Elastic Agent Inclusion of Functionality from Untrusted Control Sphere
Local attackers can execute arbitrary code in Elastic Agent by injecting parameters into the osqueryd subprocess configuration.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-52976?
CVE-2024-52976 is a medium-severity command injection vulnerability in Elastic Agent, published on 1 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Inclusion of functionality from an untrusted control sphere in Elastic Agent subprocess, osqueryd, allows local attackers to execute arbitrary code via parameter injection.
An attacker requires local access and the ability to modify osqueryd configurations.
Weakness: CWE-829
Which versions are affected by CVE-2024-52976?
It affects 1 product.
Products include Elastic Elastic Agent.
How do I fix CVE-2024-52976?
No fix has been published for CVE-2024-52976 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-52976 being exploited?
There is no known exploitation of CVE-2024-52976 in the wild and no public exploit code.
Other vulnerabilities in Elastic Agent
- CVE-2026-78604 Incorrect Permission Assignment for Critical Resource in Elastic Agent Leading to Local Privilege Escalation to SYSTEM
- CVE-2023-6687 Elastic Agent Insertion of Sensitive Information into Log File
- CVE-2024-37283 Elastic Agent Insertion of Sensitive Information into Log File
- CVE-2023-46669 Elastic Agent / Elastic Endpoint Security local API key disclosure
Sources
Also known as GHSA-4xp6-cpfv-9qq6.