From 8307be9e75e4df50189e0b948f87b78e1b372d5c Mon Sep 17 00:00:00 2001
From: Marcos Ramos <42946042+maramos-elastic@users.noreply.github.com>
Date: Thu, 16 Apr 2026 14:31:32 -0300
Subject: [PATCH] [Elasticsearch] Fix auth failure when password contains YAML
 special characters

Use the escape_string Handlebars helper for the password field in all 12
Elasticsearch metrics dataset stream templates. Previously, passwords
containing YAML special characters (e.g. double quotes) were rendered
as unquoted YAML scalars, causing the YAML parser to strip the special
chars before passing the value to the Beat.

For example, a password of "mysecret" rendered as:
  password: "mysecret"
which YAML parses as the string 'mysecret' (quotes stripped), causing
401 Unauthorized errors.

With escape_string, the same password renders as:
  password: '"mysecret"'
which YAML correctly parses back to '"mysecret"'.

Fixes: https://github.com/elastic/integrations/issues/18434
---
 packages/elasticsearch/changelog.yml                         | 5 +++++
 .../data_stream/ccr/agent/stream/stream.yml.hbs              | 2 +-
 .../data_stream/cluster_stats/agent/stream/stream.yml.hbs    | 2 +-
 .../data_stream/enrich/agent/stream/stream.yml.hbs           | 2 +-
 .../data_stream/index/agent/stream/stream.yml.hbs            | 2 +-
 .../data_stream/index_recovery/agent/stream/stream.yml.hbs   | 2 +-
 .../data_stream/index_summary/agent/stream/stream.yml.hbs    | 2 +-
 .../data_stream/ingest_pipeline/agent/stream/stream.yml.hbs  | 2 +-
 .../data_stream/ml_job/agent/stream/stream.yml.hbs           | 2 +-
 .../data_stream/node/agent/stream/stream.yml.hbs             | 2 +-
 .../data_stream/node_stats/agent/stream/stream.yml.hbs       | 2 +-
 .../data_stream/pending_tasks/agent/stream/stream.yml.hbs    | 2 +-
 .../data_stream/shard/agent/stream/stream.yml.hbs            | 2 +-
 packages/elasticsearch/manifest.yml                          | 2 +-
 14 files changed, 18 insertions(+), 13 deletions(-)

diff --git a/packages/elasticsearch/changelog.yml b/packages/elasticsearch/changelog.yml
index 7222ee89ca6..1ac10a295c7 100644
--- a/packages/elasticsearch/changelog.yml
+++ b/packages/elasticsearch/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.20.2"
+  changes:
+    - description: Fix authentication failure when password contains YAML special characters (e.g. double quotes) by using the escape_string Handlebars helper.
+      type: bugfix
+      link: https://github.com/elastic/integrations/issues/18434
 - version: "1.20.1"
   changes:
     - description: Make Elasticsearch server log pipeline tolerate missing elasticsearch fields
diff --git a/packages/elasticsearch/data_stream/ccr/agent/stream/stream.yml.hbs b/packages/elasticsearch/data_stream/ccr/agent/stream/stream.yml.hbs
index 4431e985233..8841657e0e0 100644
--- a/packages/elasticsearch/data_stream/ccr/agent/stream/stream.yml.hbs
+++ b/packages/elasticsearch/data_stream/ccr/agent/stream/stream.yml.hbs
@@ -8,7 +8,7 @@ scope: {{scope}}
 username: {{username}}
 {{/if}}
 {{#if password}}
-password: {{password}}
+password: {{escape_string password}}
 {{/if}}
 {{#if api_key}}
 api_key: {{api_key}}
diff --git a/packages/elasticsearch/data_stream/cluster_stats/agent/stream/stream.yml.hbs b/packages/elasticsearch/data_stream/cluster_stats/agent/stream/stream.yml.hbs
index 2a371f8127c..7c6fb313434 100644
--- a/packages/elasticsearch/data_stream/cluster_stats/agent/stream/stream.yml.hbs
+++ b/packages/elasticsearch/data_stream/cluster_stats/agent/stream/stream.yml.hbs
@@ -8,7 +8,7 @@ scope: {{scope}}
 username: {{username}}
 {{/if}}
 {{#if password}}
-password: {{password}}
+password: {{escape_string password}}
 {{/if}}
 {{#if api_key}}
 api_key: {{api_key}}
diff --git a/packages/elasticsearch/data_stream/enrich/agent/stream/stream.yml.hbs b/packages/elasticsearch/data_stream/enrich/agent/stream/stream.yml.hbs
index 7e53d56abb3..f6299aa1591 100644
--- a/packages/elasticsearch/data_stream/enrich/agent/stream/stream.yml.hbs
+++ b/packages/elasticsearch/data_stream/enrich/agent/stream/stream.yml.hbs
@@ -8,7 +8,7 @@ scope: {{scope}}
 username: {{username}}
 {{/if}}
 {{#if password}}
-password: {{password}}
+password: {{escape_string password}}
 {{/if}}
 {{#if api_key}}
 api_key: {{api_key}}
diff --git a/packages/elasticsearch/data_stream/index/agent/stream/stream.yml.hbs b/packages/elasticsearch/data_stream/index/agent/stream/stream.yml.hbs
index f3c479c474d..4984dd87285 100644
--- a/packages/elasticsearch/data_stream/index/agent/stream/stream.yml.hbs
+++ b/packages/elasticsearch/data_stream/index/agent/stream/stream.yml.hbs
@@ -8,7 +8,7 @@ scope: {{scope}}
 username: {{username}}
 {{/if}}
 {{#if password}}
-password: {{password}}
+password: {{escape_string password}}
 {{/if}}
 {{#if api_key}}
 api_key: {{api_key}}
diff --git a/packages/elasticsearch/data_stream/index_recovery/agent/stream/stream.yml.hbs b/packages/elasticsearch/data_stream/index_recovery/agent/stream/stream.yml.hbs
index 5ee6375830a..f37265a6715 100644
--- a/packages/elasticsearch/data_stream/index_recovery/agent/stream/stream.yml.hbs
+++ b/packages/elasticsearch/data_stream/index_recovery/agent/stream/stream.yml.hbs
@@ -9,7 +9,7 @@ scope: {{scope}}
 username: {{username}}
 {{/if}}
 {{#if password}}
-password: {{password}}
+password: {{escape_string password}}
 {{/if}}
 {{#if api_key}}
 api_key: {{api_key}}
diff --git a/packages/elasticsearch/data_stream/index_summary/agent/stream/stream.yml.hbs b/packages/elasticsearch/data_stream/index_summary/agent/stream/stream.yml.hbs
index c39a81cc8dc..3f4cf5235d1 100644
--- a/packages/elasticsearch/data_stream/index_summary/agent/stream/stream.yml.hbs
+++ b/packages/elasticsearch/data_stream/index_summary/agent/stream/stream.yml.hbs
@@ -8,7 +8,7 @@ scope: {{scope}}
 username: {{username}}
 {{/if}}
 {{#if password}}
-password: {{password}}
+password: {{escape_string password}}
 {{/if}}
 {{#if api_key}}
 api_key: {{api_key}}
diff --git a/packages/elasticsearch/data_stream/ingest_pipeline/agent/stream/stream.yml.hbs b/packages/elasticsearch/data_stream/ingest_pipeline/agent/stream/stream.yml.hbs
index b643a766159..e930fb8f0b8 100644
--- a/packages/elasticsearch/data_stream/ingest_pipeline/agent/stream/stream.yml.hbs
+++ b/packages/elasticsearch/data_stream/ingest_pipeline/agent/stream/stream.yml.hbs
@@ -8,7 +8,7 @@ scope: {{scope}}
 username: {{username}}
 {{/if}}
 {{#if password}}
-password: {{password}}
+password: {{escape_string password}}
 {{/if}}
 {{#if api_key}}
 api_key: {{api_key}}
diff --git a/packages/elasticsearch/data_stream/ml_job/agent/stream/stream.yml.hbs b/packages/elasticsearch/data_stream/ml_job/agent/stream/stream.yml.hbs
index 734459d2ccd..2bbb4c21862 100644
--- a/packages/elasticsearch/data_stream/ml_job/agent/stream/stream.yml.hbs
+++ b/packages/elasticsearch/data_stream/ml_job/agent/stream/stream.yml.hbs
@@ -8,7 +8,7 @@ scope: {{scope}}
 username: {{username}}
 {{/if}}
 {{#if password}}
-password: {{password}}
+password: {{escape_string password}}
 {{/if}}
 {{#if api_key}}
 api_key: {{api_key}}
diff --git a/packages/elasticsearch/data_stream/node/agent/stream/stream.yml.hbs b/packages/elasticsearch/data_stream/node/agent/stream/stream.yml.hbs
index 38a49e39908..d977bb3003e 100644
--- a/packages/elasticsearch/data_stream/node/agent/stream/stream.yml.hbs
+++ b/packages/elasticsearch/data_stream/node/agent/stream/stream.yml.hbs
@@ -8,7 +8,7 @@ scope: {{scope}}
 username: {{username}}
 {{/if}}
 {{#if password}}
-password: {{password}}
+password: {{escape_string password}}
 {{/if}}
 {{#if api_key}}
 api_key: {{api_key}}
diff --git a/packages/elasticsearch/data_stream/node_stats/agent/stream/stream.yml.hbs b/packages/elasticsearch/data_stream/node_stats/agent/stream/stream.yml.hbs
index 7c40969f1f8..70738179d19 100644
--- a/packages/elasticsearch/data_stream/node_stats/agent/stream/stream.yml.hbs
+++ b/packages/elasticsearch/data_stream/node_stats/agent/stream/stream.yml.hbs
@@ -8,7 +8,7 @@ scope: {{scope}}
 username: {{username}}
 {{/if}}
 {{#if password}}
-password: {{password}}
+password: {{escape_string password}}
 {{/if}}
 {{#if api_key}}
 api_key: {{api_key}}
diff --git a/packages/elasticsearch/data_stream/pending_tasks/agent/stream/stream.yml.hbs b/packages/elasticsearch/data_stream/pending_tasks/agent/stream/stream.yml.hbs
index adf3c05e2ea..45010476ba5 100644
--- a/packages/elasticsearch/data_stream/pending_tasks/agent/stream/stream.yml.hbs
+++ b/packages/elasticsearch/data_stream/pending_tasks/agent/stream/stream.yml.hbs
@@ -8,7 +8,7 @@ scope: {{scope}}
 username: {{username}}
 {{/if}}
 {{#if password}}
-password: {{password}}
+password: {{escape_string password}}
 {{/if}}
 {{#if api_key}}
 api_key: {{api_key}}
diff --git a/packages/elasticsearch/data_stream/shard/agent/stream/stream.yml.hbs b/packages/elasticsearch/data_stream/shard/agent/stream/stream.yml.hbs
index 5e14b3e2342..5308840d456 100644
--- a/packages/elasticsearch/data_stream/shard/agent/stream/stream.yml.hbs
+++ b/packages/elasticsearch/data_stream/shard/agent/stream/stream.yml.hbs
@@ -8,7 +8,7 @@ scope: {{scope}}
 username: {{username}}
 {{/if}}
 {{#if password}}
-password: {{password}}
+password: {{escape_string password}}
 {{/if}}
 {{#if api_key}}
 api_key: {{api_key}}
diff --git a/packages/elasticsearch/manifest.yml b/packages/elasticsearch/manifest.yml
index 68219f2c796..854c34cf059 100644
--- a/packages/elasticsearch/manifest.yml
+++ b/packages/elasticsearch/manifest.yml
@@ -1,6 +1,6 @@
 name: elasticsearch
 title: Elasticsearch
-version: 1.20.1
+version: 1.20.2
 description: Elasticsearch Integration
 type: integration
 icons: