Threat database

CVE-2026-103009 is a high-severity authorization bypass vulnerability in Elasticsearch affecting versions 8.13.0 through 8.19.22, 9.0.0 through 9.4.7, and 9.5.0 through 9.5.4. It involves the Remote Cluster Security 2.0 model where a cross-cluster search request can be crafted to bypass authorization checks by using mismatched shard identifiers. This allows an attacker with a cross-cluster API key authorized for one index to access documents, field mappings, and metadata of an unauthorized index, and in limited cases modify retention-lease state. The vulnerability has a CVSS score of 7.1 and no known exploits in the wild have been reported. Patch status is not confirmed from the provided data.

CVE-2026-103008 is an uncontrolled recursion vulnerability in Elastic Elasticsearch that can cause a denial of service. It arises from how Elasticsearch builds and serializes geometry values produced by scripted runtime fields without bounding recursion depth. An authenticated user with read access can submit a crafted request that triggers deep recursion, exhausting stack space and terminating the node. The node may not automatically recover, requiring manual intervention. The vulnerability affects multiple Elasticsearch versions from 8.12.0 through 9.5.4.

CVE-2026-103007 is an incorrect authorization vulnerability in Elastic Elasticsearch that allows privilege escalation. It arises from a delegated administrative privilege whose scope is not fully enforced during authorization checks. A user with this delegated privilege can exploit the flaw to update their own role and gain unauthorized access to restricted indices, including internal security data, potentially escalating to full administrative control of the cluster.

CVE-2026-103006 is an uncontrolled recursion vulnerability in Elasticsearch's search aggregation feature. An authenticated user with read access to an index can submit a deeply nested aggregation request that triggers unbounded recursion. This leads to resource exhaustion and causes the affected node to terminate and require manual recovery. The vulnerability affects multiple versions of Elasticsearch from 8.0.0 through 8.19.20, 9.0.0 through 9.4.5, and 9.5.0 through 9.5.1. The CVSS score is 6.5, indicating medium severity.

CVE-2026-103005 is a medium severity vulnerability in Elasticsearch involving excessive memory allocation. An authenticated user with connector management privileges can create connector resources with an excessively large description field, causing the cluster to allocate uncontrolled amounts of memory. This can exhaust heap memory and crash affected nodes, resulting in a denial of service condition.

CVE-2026-102413 is an uncaught exception vulnerability in Elastic Endpoint, part of Elastic Agent and Elastic Defend, triggered by processing specially crafted file names under certain system locale settings on Windows. This causes the Elastic Endpoint process to crash and restart repeatedly, potentially degrading or disabling real-time malware prevention and behavioral detection on the affected host. The issue affects multiple versions from 8.19.13 through 9.5.4. The vulnerability has a CVSS score of 6.2, indicating medium severity.

CVE-2026-102412 is an incorrect authorization vulnerability in Elastic Kibana affecting versions 9.3.0 through 9.3.8, 9.4.0 through 9.4.7, and 9.5.0 through 9.5.4. It allows an authenticated user with limited Fleet management privileges to access sensitive credential material that should be restricted to Fleet settings administrators. This could lead to disclosure of private cryptographic key material used for Fleet Server host connections. The vulnerability has a medium severity with a CVSS score of 6.5.

CVE-2026-102411 is a resource allocation vulnerability in Elasticsearch where multiple template resources with user-supplied metadata can collectively exhaust heap memory, causing node failure and denial of service. The issue arises because while individual metadata fields have size limits, the total memory used when retrieving multiple such resources together is not limited. This affects Elasticsearch versions 8.0.0 through 8.19.22, 9.0.0 through 9.4.6, and 9.5.0 through 9.5.2. The vulnerability requires the attacker to have the manage_index_templates cluster privilege. The CVSS score is 6.5 (medium severity) with no confidentiality or integrity impact but high availability impact.

CVE-2026-102410 is a medium severity vulnerability in Elastic Kibana versions 9.2.0 through 9.3.8. It involves missing authorization checks in an internal API within the Metrics Experience feature, allowing users with only data-store-level read access to retrieve metric data that should require higher Kibana feature privileges. This flaw results from inconsistent enforcement of access control lists (ACLs) between related APIs in the same feature.

CVE-2026-102409 is an uncontrolled recursion vulnerability in Elastic Elasticsearch that allows an authenticated user with low privileges to cause a denial of service by terminating an Elasticsearch node. The issue arises from excessive allocation leading to resource exhaustion. It affects multiple 9.x versions of Elasticsearch. The vulnerability has a medium severity rating with a CVSS score of 6.5. No known exploits are reported in the wild and no official patch information is provided in the source data.

CVE-2026-102408 is a medium severity vulnerability in Elastic Elasticsearch involving inefficient regular expression complexity. The ES|QL CHUNK function accepts user-supplied regular expressions without validating their computational complexity or bounding execution time. An authenticated user with read access to any text-based index can submit crafted regex patterns that cause catastrophic backtracking, leading to excessive CPU consumption and degraded query throughput on affected nodes. The issue results in denial of service conditions but does not crash the cluster.

CVE-2026-102407 is an incorrect authorization vulnerability in Elastic Elasticsearch that allows an authenticated user with privileges on one resource to modify data streams they are not authorized to access. This vulnerability affects multiple Elasticsearch versions from 7.17.5 through 9.4.3. It does not permit unauthorized reading of data stream contents but can lead to unauthorized modification or injection of data, potentially disrupting search functionality. The CVSS score is 5.4, indicating medium severity.

CVE-2026-102406 is a high-severity authorization bypass vulnerability in Elastic Kibana affecting versions 8.14.0 through 8.19.21, 9.0.0 through 9.4.6, and 9.5.0 through 9.5.3. It allows a user with delegated Fleet package-management privileges to claim a data stream identifier already in use by another tenant without proper ownership verification. This can lead to cross-tenant data interception, unauthorized disclosure, modification, and disruption of data delivery. The interception may persist even after the malicious package is removed, requiring additional remediation of the affected infrastructure.

CVE-2026-102404 is a medium severity vulnerability in Elastic Elasticsearch affecting versions 8.0.0 through 8.19.22, 9.0.0 through 9.4.7, and 9.5.0 through 9.5.4. It involves uncontrolled resource consumption (CWE-400) where a low-privileged authenticated user can submit crafted queries that cause excessive memory allocation. This leads to out-of-memory conditions that terminate Elasticsearch nodes, potentially causing persistent cluster unavailability.

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130)

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)