CVE-2026-56144: CWE-863 Incorrect Authorization in Elastic Elasticsearch

This vulnerability (CWE-863) in Elasticsearch arises from insufficient authorization controls in the ingest simulation feature. Authenticated users with limited privileges can exploit this flaw to cause ingest pipelines configured on unauthorized indices to execute and return output, potentially disclosing sensitive data processed or enriched by those pipelines. Additionally, the feature can be abused to retrieve index mapping metadata for indices outside the user's direct access rights. The issue affects Elasticsearch versions 8.12.0, 9.0.0, and 9.4.0. No known exploits are reported in the wild, and no vendor patch or advisory details are provided in the input.

An authenticated user with limited privileges can indirectly access data processed by ingest pipelines on indices they are not authorized to access, leading to potential data disclosure. They can also obtain index mapping metadata for unauthorized indices. There is no indication of integrity or availability impact. The vulnerability has a medium severity rating with a CVSS score of 5.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of an official fix or vendor advisory, monitor for updates from Elastic and consider restricting access to the ingest simulation feature or limiting user privileges further as a precaution.