Incorrect authorization in Elasticsearch - CVE-2026-103007
Published: October 7, 2026
Vulnerability details
The vulnerability allows a remote user to escalate privileges up to full administrative control of the cluster.
The vulnerability exists due to incorrect authorization in the delegated role-management privilege (manage_roles) when checking index-scoped permissions for role definitions containing a setting that expands the matched index set. A remote privileged user can update their own assigned role to access restricted indices, including internal security data, to escalate privileges up to full administrative control of the cluster.
Exploitation requires a grant of the configurable, non-default manage_roles privilege with wildcard or regular-expression index patterns that can match restricted or system indices. Delegations scoped only to literal index names are not affected. The affected feature is not available on Elastic Cloud Serverless.