CVE-2023-31416: Elastic Cloud On Kubernetes

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

Secret token configuration is never applied when using ECK <2.8 with APM Server >=8.0. This could lead to anonymous requests to an APM Server being accepted and the data ingested into this APM deployment.

Affected products

• Elastic Elastic Cloud On Kubernetes: before 2.8 (fixed in 2.8)

Published 2023-10-26. Last modified 2026-06-17.