SB20261007240 - Multiple vulnerabilities in Elasticsearch

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261007240

SB20261007240 - Multiple vulnerabilities in Elasticsearch

Published: October 7, 2026

Security Bulletin ID SB20261007240
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 vulnerabilities.


1) Uncontrolled Recursion (CVE-ID: CVE-2026-102409)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to terminate an Elasticsearch node and cause a denial of service.

The vulnerability exists due to uncontrolled recursion in the text chunking functionality when processing ES|QL queries. A remote user can submit queries that trigger excessive allocation to terminate an Elasticsearch node and cause a denial of service.

Exploitation requires ES|QL to be enabled and index read access permitting query submission. ES|QL is enabled by default.


2) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-102411)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in Elasticsearch's template resource metadata retrieval mechanism when retrieving multiple template resources together. A remote user can register multiple template resources with metadata within the individual size limit and retrieve them together to cause a denial of service by exhausting the affected node's available heap memory.

Exploitation requires the manage_index_templates cluster privilege.


3) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-103009)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information from unauthorized indices and, in limited cases, modify their retention-lease state.

The vulnerability exists due to authorization bypass through a user-controlled key in Elasticsearch's cross-cluster search request handling when processing requests through the Remote Cluster Security (RCS) 2.0 model. A remote user can send a specially crafted request with independently supplied shard-identifying attributes that authorize access against one index but select a different, unauthorized index to disclose sensitive information from unauthorized indices and, in limited cases, modify their retention-lease state.

Exploitation requires a cross-cluster API key authorized for at least one index. Only fulfilling clusters exposing a remote cluster transport port for cross-cluster search are affected. The issue is not exploitable through the REST API and does not apply to Elastic Cloud Serverless.


4) Uncontrolled Recursion (CVE-ID: CVE-2026-103008)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in Elasticsearch's geometry construction and serialization for scripted runtime fields when processing geometry values produced by scripts without a recursion-depth limit. A remote user can submit a specially crafted request defining a runtime field with a script that produces a deeply nested structure to cause a denial of service.

Exploitation requires read access to a single index. All configurations are affected.


5) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-103005)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to memory allocation with an excessive size value in the Elasticsearch Connector API when connector resources with excessively large description fields are created and subsequently accessed. A remote user can create such connector resources and subsequently access them to cause a denial of service.

Exploitation requires connector management privileges and a configuration that exposes the Connector API.


6) Resource exhaustion (CVE-ID: CVE-2026-102404)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the Elasticsearch query processing engine when processing ES|QL queries. A remote user can submit a specially crafted query that causes uncontrolled memory growth and an out-of-memory condition that terminates the Elasticsearch node to cause a denial of service.

No special configuration is required beyond the default configuration. Queries embedded in shared resources can also trigger the condition.


7) Inefficient regular expression complexity (CVE-ID: CVE-2026-102408)

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to inefficient regular expression complexity in the ES|QL CHUNK function's recursive chunking strategy when processing user-supplied regular expressions as text-splitting separators. A remote user can submit a specially crafted regular expression that triggers catastrophic backtracking and excessive CPU consumption on Elasticsearch worker threads to cause a denial of service.

Exploitation requires read access to a text-family index; the built-in viewer role is sufficient. Query throughput for other tenants on the affected node is degraded, but the cluster does not crash.


8) Incorrect authorization (CVE-ID: CVE-2026-103007)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to escalate privileges up to full administrative control of the cluster.

The vulnerability exists due to incorrect authorization in the delegated role-management privilege (manage_roles) when checking index-scoped permissions for role definitions containing a setting that expands the matched index set. A remote privileged user can update their own assigned role to access restricted indices, including internal security data, to escalate privileges up to full administrative control of the cluster.

Exploitation requires a grant of the configurable, non-default manage_roles privilege with wildcard or regular-expression index patterns that can match restricted or system indices. Delegations scoped only to literal index names are not affected. The affected feature is not available on Elastic Cloud Serverless.


Remediation

Install update from vendor's website.

References