CVE-2023-46667

CVE-2023-46667 is a high-severity vulnerability affecting Elastic Fleet Server versions 8.10.0 through 8.10.2, where agent enrollment tokens are logged in plain text. This flaw allows an authenticated attacker to retrieve these tokens, potentially enabling them to enroll new agents into existing policies. Such access could lead to the compromise of sensitive secrets, including those for Elasticsearch and third-party services, or allow the attacker to send arbitrary events to Elasticsearch. While the CVSS score is 8.1 (High), there is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.