Threats Tagged 'cve-2026-78607'

CVE-2026-78607 is a high-severity vulnerability in Elasticsearch's custom inference service where missing authorization allows users with inference execution privileges to redirect outbound inference traffic and potentially expose administrator credentials. This flaw involves privilege abuse due to lack of proper authorization checks.

CVE-2026-78607 is a vulnerability involving missing authorization in Elasticsearch components related to Microsoft Azure Linux 3.0 and rubygem-elasticsearch. This flaw could lead to unauthorized information disclosure due to insufficient access control. No CVSS score or detailed technical exploitation data is provided. There is no indication of known exploits in the wild or available patches. The affected versions include Microsoft Azure Linux 3.0 and rubygem-elasticsearch version 3.0.

Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause administrator-provisioned credentials to be exposed.