Incorrect authorization in Elasticsearch - CVE-2026-102407
Published: October 7, 2026
Vulnerability details
The vulnerability allows a remote user to modify data streams without authorization, potentially injecting data or disrupting normal searches.
The vulnerability exists due to incorrect authorization in the Modify Data Streams API when processing data stream modification requests. A remote user can invoke the API against a data stream outside their authorized access to modify data streams without authorization, potentially injecting data or disrupting normal searches.
Exploitation requires sufficient privileges over a single resource. Affected configurations use Elasticsearch Security (role-based access control) together with data streams; no non-default configuration is required. The issue does not permit reading the contents of otherwise inaccessible data streams.