CVE-2026-72687 is a medium severity vulnerability in Elasticsearch where a low-privileged authenticated user can cause a denial of service by submitting a crafted request with a forged opaque identifier. This identifier contains a size value that triggers an unbounded memory allocation, leading to an out-of-memory condition that crashes the node process.
CVE-2026-72686 is a medium severity vulnerability in Elasticsearch where a low-privileged authenticated user can cause a denial of service by submitting a crafted input that triggers uncontrolled recursion during input validation. This recursion exhausts the thread's stack, causing the node process to terminate unexpectedly. The flaw affects multiple Elasticsearch versions prior to fixed releases. A patch is available to address this issue.
CVE-2026-72685 is a medium severity vulnerability in Elasticsearch where a low-privileged authenticated user who can index documents can submit a crafted small document that causes a worker thread to be occupied for a disproportionate amount of time. This leads to degraded availability of indexing operations on the affected node.
CVE-2026-72684 is a medium severity vulnerability in Elasticsearch that allows an authenticated user with read privileges to cause a denial of service. By submitting a crafted search request, the user can trigger unbounded memory allocation in an internal component outside existing memory controls. This leads to an out-of-memory condition that terminates the affected node process, disrupting service availability. The vulnerability affects Elasticsearch versions from 8.0.0 up to but not including 9.5.0. A patch is available to address this issue.
CVE-2026-72683 is a vulnerability in Elasticsearch where an authenticated user with privileges to invoke the simulate pipeline API can submit a request that creates a self-referential data structure. This causes an internal component to recurse indefinitely, leading to a fatal error that terminates the node process and results in denial of service. The flaw affects multiple Elasticsearch versions prior to patched releases. No known exploits are reported in the wild. A patch is available to address this issue.
A vulnerability in Elasticsearch allows an authenticated user with read-only access on a single index to cause a denial of service by triggering uncontrolled recursion in an intervals query pattern. The issue arises because Elasticsearch does not enforce its input length restriction on the user-supplied pattern, leading to unbounded recursion that exhausts the thread stack and terminates the node process. This affects specific versions of Elasticsearch and can disrupt service availability for the affected node.
CVE-2026-72678 is a medium severity vulnerability in Elasticsearch where an authenticated user with read privileges can cause the node to allocate an excessively large amount of memory by submitting a crafted request. This leads to memory exhaustion and a fatal error that terminates the Elasticsearch node process, resulting in denial of service and degraded cluster health. The issue is exploitable with a single request regardless of heap size configuration. A patch is available for affected versions.
CVE-2026-72656 is a medium severity vulnerability in Elasticsearch affecting versions from 8.11.0 up to but not including 8.17.10. It involves memory allocation with an excessive size value during ES|QL query processing, which can lead to denial of service by exhausting heap memory on the node. An authenticated user submitting a specially crafted ES|QL query can trigger this condition, causing the node to become unavailable.
CVE-2026-72647 is a medium severity vulnerability in Elasticsearch involving uncontrolled recursion that can lead to denial of service. An authenticated user with read privileges on a single index can submit a specially crafted search request with deeply nested serialized data. This request is processed without a depth limit, causing exhaustion of the thread stack and termination of the affected node. The vulnerability affects Elasticsearch versions from 8.0.0 up to but not including 8.19.20, and from 9.0.0 up to but not including 9.4.5. A patch is available to address this issue.
CVE-2026-72645 is a medium severity vulnerability in Elasticsearch where an authenticated user with read privileges on a single index can trigger excessive memory allocation. This occurs via a specially crafted search request that causes the JVM heap to be exhausted, leading to denial of service by terminating the affected node. The vulnerability affects multiple Elasticsearch versions from 8.0.0 up to but not including 8.19.20, 9.0.0 up to but not including 9.4.5, and 9.5.0 up to but not including 9.5.1. A patch is available to address this issue.
CVE-2026-72642 is a high-severity vulnerability in Elasticsearch's machine learning native inference process. It allows a user with privileges to upload and deploy trained models to craft a model that performs out-of-bounds memory reads and writes. This leads to heap corruption, causing crashes of the inference process and potentially enabling arbitrary code execution within that process context. The vulnerability affects specific Elasticsearch versions 8.19.0 through 8.19.19, 9.4.0 through 9.4.4, and 9.5.0. Patch updates are available to address this issue.
CVE-2026-72639 is a vulnerability in Elasticsearch where the system does not enforce an upper limit on a user-supplied count in the search highlighting feature. An authenticated user with read privileges on a single index can submit a crafted search request that causes the node to allocate an excessively large internal data structure. This allocation happens before safety limits are checked, leading to memory exhaustion and a fatal error that terminates the Elasticsearch node process. This results in a denial of service affecting the node and cluster health. The vulnerability is exploitable with a single request and does not depend on the size of indexed data. A patch is available to address this issue.
CVE-2026-72638 is a medium severity vulnerability in Elasticsearch where uncontrolled recursion in processing custom analysis definitions can cause denial of service. An authenticated user with low-privileged index creation permissions can submit a specially crafted request that triggers recursive resolution without cycle or depth checks. This exhausts the thread stack and crashes the affected node. The issue affects Elasticsearch versions from 8.0.0 up to but not including 8.19.20, and from 9.0.0 up to but not including 9.4.5. A patch is available to address this vulnerability.
CVE-2026-72636 is a medium severity vulnerability in Elasticsearch affecting versions 8.0.0 up to but not including 8.19.20 and 9.0.0 up to but not including 9.4.5. It involves uncontrolled recursion in the wildcard matching helper, which can cause a denial of service by exhausting the thread stack and shutting down the node. This occurs when a search request contains a wildcard pattern with many wildcard groups evaluated against a long name, leading to a stack overflow that Elasticsearch treats as unrecoverable.
Concourse versions prior to 8.2.3 contain an open redirect vulnerability in the login flow. An attacker can craft a URL that redirects users from the Concourse web server to arbitrary external sites. This vulnerability could facilitate phishing attacks aimed at stealing user credentials. The issue has been fixed in version 8.2.3. No known workarounds exist.
A critical vulnerability in goauthentik authentik prior to versions 2026.2.6 and 2026.5.5 allows an attacker with an account on the source identity provider to perform account takeover. The flaw involves an XML comment injection in the NameID field when using non-default user-matching modes (USERNAME_LINK or EMAIL_LINK), causing truncation of the interpreted value and enabling binding of the attacker's identity to a victim's account without needing the victim's password or the identity provider's private key. This issue does not affect the default unique-identifier matching mode or authentik's outbound SAML Provider role. The vulnerability is fixed in versions 2026.2.6 and 2026.5.5.
authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an unauthenticated client, can invoke the diagnostic action against a configured LDAP Source. The server then connects to the upstream directory using the source's configured bind credentials and returns a bounded set of directory entries. The response exposes the distinguished names of those entries and the names of the attributes present on them, revealing directory structure, naming conventions, and the existence of specific accounts and groups, but not attribute values. Deployments without a configured LDAP Source are not affected. This issue is fixed in versions 2026.2.6 and 2026.5.5.
authentik versions prior to 2026.2.6 and between 2026.5.0 and before 2026.5.5 contain an authorization bypass vulnerability in the Remote Access Control endpoint listing. Authenticated users can retrieve all configured endpoints and their connection settings, including stored credentials, regardless of their access rights. This flaw allows unauthorized access to managed RDP, SSH, and VNC targets, exposing sensitive credentials and enabling interactive access to systems outside the user's authorization scope. Deployments not using the enterprise Remote Access Control provider are not affected. The issue is fixed in versions 2026.2.6 and 2026.5.5.
authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the enterprise Google Chrome device-trust stages advance the flow without confirming that the out-of-band device attestation actually ran. Affected enterprise deployments place either a Google Chrome Endpoint stage with mode set to REQUIRED or the deprecated Google Chrome Device Trust Connector stage in an authentication flow. The device attestation occurs in a verification iframe that calls the Google Verified Access API and records the verified device on success, but the vulnerable stages treat the flow as passed as soon as the stage is submitted. An attacker who can reach such a stage, including after primary username and password authentication, can skip the verification iframe and authenticate from a device that was never verified. Where device trust is the only additional factor, that protection is fully bypassed, while other configured factors remain in force. This issue is fixed in versions 2026.2.6 and 2026.5.5.
CVE-2026-73372 is an improper access control vulnerability in Joomla! CMS affecting versions 5.1.0 through 5.4.6 and 6.0.0 through 6.1.2. The flaw allows injection of contact information for inaccessible contact items into schema.org snippets due to improper ACL checks. The vulnerability has a medium severity with a CVSS 4.0 score of 5.1.