CVE-2026-78607: CWE-862 Missing Authorization in Elastic Elasticsearch

This vulnerability in Elasticsearch's custom inference service results from missing authorization checks (CWE-862). A user with limited inference execution privileges can abuse this flaw to redirect outbound inference traffic to destinations of their choice, leading to information disclosure through exposure of administrator credentials. The CVSS 3.1 base score is 5.4 (medium), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and limited confidentiality and integrity impact. Affected versions explicitly include 8.0.0, 9.0.0, 9.4.0, and 9.5.0. There is no vendor advisory or patch information available at this time.

An attacker with inference execution privileges can cause outbound inference traffic to be redirected, potentially exposing sensitive administrator credentials. This leads to information disclosure and privilege abuse. The impact is limited to confidentiality and integrity with no availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict inference execution privileges to trusted users only and monitor for unusual outbound inference traffic patterns.