Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2026-78607

Missing Authorization in Elasticsearch Leading to Information Disclosure

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
elastic

Description

Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause administrator-provisioned credentials to be exposed.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Elastic Elasticsearch

Default version status: unaffected

  • 8.0.0 to ≤ 8.19.18affected
  • 9.0.0 to ≤ 9.3.7affected
  • 9.4.0 to ≤ 9.4.3affected
  • 9.5.0affected

References