CVE-2026-56144
published 2026-07-21CVE-2026-56144: Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls…
PriorityP341medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.32%
23.1th percentile
Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature. By targeting indices they are not authorized to access directly, the user can cause those indices' configured ingest pipelines to execute and return their output, potentially disclosing data processed or enriched by those pipelines. Additionally, the same feature can be used to retrieve index mapping metadata for indices the user are not authorized to access directly.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | elasticsearch | >= 8.12.0 < 8.19.18 | 8.19.18 |
| elastic | elasticsearch | 8.12.0 – 8.19.18 | — |
| elastic | elasticsearch | >= 9.0.0 < 9.3.7 | 9.3.7 |
| elastic | elasticsearch | 9.0.0 – 9.3.7 | — |
| elastic | elasticsearch | >= 9.4.0 < 9.4.4 | 9.4.4 |
| elastic | elasticsearch | 9.4.0 – 9.4.3 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Elastic Elasticsearch vor up to 8.19.17/9.3.6/9.4.3 ingest simulation feature authorization
vuldb·2026-08-08·CVSS 6.5
CVE-2026-56144 [MEDIUM] Elastic Elasticsearch vor up to 8.19.17/9.3.6/9.4.3 ingest simulation feature authorization
A vulnerability was found in Elastic Elasticsearch and classified as critical. Impacted is an unknown function of the component ingest simulation feature. Such manipulation leads to incorrect authorization.
This vulnerability is documented as CVE-2026-56144. The attack can be executed remotely. There is not any exploit available.
It is suggested to upgrade the affected component.
GHSA
Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature.
ghsa_unreviewed·2026-07-21
CVE-2026-56144 [MEDIUM] CWE-863 Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature.
Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature. By targeting indices they are not authorized to access directly, the user can cause those indices' configured ingest pipelines to execute and return their output, potentially disclosing data processed or enriched by those pipelines. Additionally, the same feature can be used to retrieve index mapping metadata for indices the user are not authorized to access directly.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-21
Published