CVE-2026-103009 is a high-severity authorization bypass vulnerability in Elasticsearch affecting versions 8.13.0 through 8.19.22, 9.0.0 through 9.4.7, and 9.5.0 through 9.5.4. It involves the Remote Cluster Security 2.0 model where a cross-cluster search request can be crafted to bypass authorization checks by using mismatched shard identifiers. This allows an attacker with a cross-cluster API key authorized for one index to access documents, field mappings, and metadata of an unauthorized index, and in limited cases modify retention-lease state. The vulnerability has a CVSS score of 7.1 and no known exploits in the wild have been reported. Patch status is not confirmed from the provided data.
CVE-2026-103008 is an uncontrolled recursion vulnerability in Elastic Elasticsearch that can cause a denial of service. It arises from how Elasticsearch builds and serializes geometry values produced by scripted runtime fields without bounding recursion depth. An authenticated user with read access can submit a crafted request that triggers deep recursion, exhausting stack space and terminating the node. The node may not automatically recover, requiring manual intervention. The vulnerability affects multiple Elasticsearch versions from 8.12.0 through 9.5.4.
CVE-2026-103007 is an incorrect authorization vulnerability in Elastic Elasticsearch that allows privilege escalation. It arises from a delegated administrative privilege whose scope is not fully enforced during authorization checks. A user with this delegated privilege can exploit the flaw to update their own role and gain unauthorized access to restricted indices, including internal security data, potentially escalating to full administrative control of the cluster.
CVE-2026-103006 is an uncontrolled recursion vulnerability in Elasticsearch's search aggregation feature. An authenticated user with read access to an index can submit a deeply nested aggregation request that triggers unbounded recursion. This leads to resource exhaustion and causes the affected node to terminate and require manual recovery. The vulnerability affects multiple versions of Elasticsearch from 8.0.0 through 8.19.20, 9.0.0 through 9.4.5, and 9.5.0 through 9.5.1. The CVSS score is 6.5, indicating medium severity.
CVE-2026-103005 is a medium severity vulnerability in Elasticsearch involving excessive memory allocation. An authenticated user with connector management privileges can create connector resources with an excessively large description field, causing the cluster to allocate uncontrolled amounts of memory. This can exhaust heap memory and crash affected nodes, resulting in a denial of service condition.
CVE-2026-102411 is a resource allocation vulnerability in Elasticsearch where multiple template resources with user-supplied metadata can collectively exhaust heap memory, causing node failure and denial of service. The issue arises because while individual metadata fields have size limits, the total memory used when retrieving multiple such resources together is not limited. This affects Elasticsearch versions 8.0.0 through 8.19.22, 9.0.0 through 9.4.6, and 9.5.0 through 9.5.2. The vulnerability requires the attacker to have the manage_index_templates cluster privilege. The CVSS score is 6.5 (medium severity) with no confidentiality or integrity impact but high availability impact.
CVE-2026-102409 is an uncontrolled recursion vulnerability in Elastic Elasticsearch that allows an authenticated user with low privileges to cause a denial of service by terminating an Elasticsearch node. The issue arises from excessive allocation leading to resource exhaustion. It affects multiple 9.x versions of Elasticsearch. The vulnerability has a medium severity rating with a CVSS score of 6.5. No known exploits are reported in the wild and no official patch information is provided in the source data.
CVE-2026-102408 is a medium severity vulnerability in Elastic Elasticsearch involving inefficient regular expression complexity. The ES|QL CHUNK function accepts user-supplied regular expressions without validating their computational complexity or bounding execution time. An authenticated user with read access to any text-based index can submit crafted regex patterns that cause catastrophic backtracking, leading to excessive CPU consumption and degraded query throughput on affected nodes. The issue results in denial of service conditions but does not crash the cluster.
CVE-2026-102404 is a medium severity vulnerability in Elastic Elasticsearch affecting versions 8.0.0 through 8.19.22, 9.0.0 through 9.4.7, and 9.5.0 through 9.5.4. It involves uncontrolled resource consumption (CWE-400) where a low-privileged authenticated user can submit crafted queries that cause excessive memory allocation. This leads to out-of-memory conditions that terminate Elasticsearch nodes, potentially causing persistent cluster unavailability.
CVE-2026-82300 is a medium severity vulnerability in Elastic Elasticsearch involving uncontrolled resource consumption (CWE-400). This flaw can lead to denial of service (DoS) through excessive allocation of resources. The vulnerability affects multiple Elasticsearch versions from 8.0.0 through 9.5.3 in various ranges. No known exploits are reported in the wild, and no explicit patch information is provided in the source data.
Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The matcher used to resolve wildcard patterns against names is implemented recursively and had no bound on recursion depth or on the total number of match operations performed. A search request containing a wildcard pattern with a large number of wildcard groups, evaluated against a sufficiently long name, exhausts the thread stack. Elasticsearch treats a stack overflow as an unrecoverable condition and shuts the node down, so the request terminates the affected node rather than failing gracefully.
The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storage. A user with the privileges required to upload and deploy a trained model can craft a model that reads and writes memory outside the intended allocation. The result is heap corruption that crashes the inference process, and, with sufficient control over the heap layout, could allow arbitrary code execution in the context of that process.
Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit breaker. An authenticated user holding only read privileges on a single searchable index can submit one small search request that causes the node to reserve an excessively large internal data structure. The allocation occurs before the existing highlighting safety limits are evaluated, so memory exhaustion raises a fatal error that terminates the Elasticsearch node process. This results in a denial of service for the affected node and degrades cluster routing and health. The defect is not volumetric and does not depend on the size of the indexed data, so a single request is sufficient.
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analysis definition that is resolved recursively without a cycle or depth check, exhausting the thread stack and terminating the affected node.