Missing Authorization in Elasticsearch Leading to Information Disclosure (CVE-2026-78607)

This vulnerability arises from missing authorization controls (CWE-862) in the Elasticsearch custom inference service. A user who has only inference execution privileges can manipulate outbound inference traffic to a destination of their choice, which can lead to the exposure of administrator-provisioned credentials. The issue is classified under privilege abuse (CAPEC-122). Affected versions include Elasticsearch versions from 8.0.0 up to but not including 8.19.19, 9.0.0 up to but not including 9.3.8, 9.4.0 up to but not including 9.4.4, and 9.5.0 up to but not including 9.5.1. The vulnerability is not known to be exploited in the wild and a patch is available.

An attacker with inference execution privileges can redirect outbound inference traffic to arbitrary destinations, potentially causing administrator credentials to be disclosed. This could lead to unauthorized access to sensitive information provisioned by administrators, increasing the risk of information disclosure within affected Elasticsearch deployments.

A patch is available for this vulnerability. Users should upgrade to fixed versions beyond the affected ranges: 8.19.19, 9.3.8, 9.4.4, and 9.5.1 or later. Since this is not a cloud service, remediation requires applying the vendor-provided updates. No additional mitigation steps are indicated beyond applying the official fixes.