Authorization bypass through user-controlled key in Elasticsearch - CVE-2026-103009
Published: October 7, 2026
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information from unauthorized indices and, in limited cases, modify their retention-lease state.
The vulnerability exists due to authorization bypass through a user-controlled key in Elasticsearch's cross-cluster search request handling when processing requests through the Remote Cluster Security (RCS) 2.0 model. A remote user can send a specially crafted request with independently supplied shard-identifying attributes that authorize access against one index but select a different, unauthorized index to disclose sensitive information from unauthorized indices and, in limited cases, modify their retention-lease state.
Exploitation requires a cross-cluster API key authorized for at least one index. Only fulfilling clusters exposing a remote cluster transport port for cross-cluster search are affected. The issue is not exploitable through the REST API and does not apply to Elastic Cloud Serverless.