CVE-2023-46668

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

If Elastic Endpoint (v7.9.0 - v8.10.3) is configured to use a non-default option in which the logging level is explicitly set to debug, and when Elastic Agent is simultaneously configured to collect and send those logs to Elasticsearch, then Elastic Agent API keys can be viewed in Elasticsearch in plaintext. These API keys could be used to write arbitrary data and read Elastic Endpoint user artifacts.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-532

Affected software

No affected versions have been published.

Timeline

Published: Oct 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-466697.1Exposure of sensitive information to local unauthorized actors in Elastic Agent and Elastic Security Endpoint can lead to loss of confidenti CVE-2023-46674.8The web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malic CVE-2023-466716.5An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error. Elastic has releas CVE-2023-466725.5An issue was identified by Elastic whereby sensitive information is recorded in Logstash logs under specific circumstances. The prerequisit CVE-2023-466737.5It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when CVE-2023-466747.8An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could hav CVE-2023-466756.5An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event whe CVE-2023-466779.8Online Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txt_uname' parameter of the sign-up.php CVE-2023-466799.8Online Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txt_uname_email' parameter of the index CVE-2023-46687.5The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai-debug-proc CVE-2023-466817.8Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in VR-S1000 firmware Ver. 2.37 and earlier CVE-2023-466837.2A post authentication command injection vulnerability exists when configuring the wireguard VPN functionality of Tp-Link ER7206 Omada Gigab