Elastic Elasticsearch vulnerabilities

CVE-2026-103009 [HIGH] CWE-639 CVE-2026-103009: Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of cross-cluster search requests made through the Remote Cluster S

CVE-2024-43709 [HIGH] CWE-770 CVE-2024-43709: An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryE An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function.

CVE-2026-56144 [MEDIUM] CWE-863 CVE-2026-56144: Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited inde Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature. By targeting indices they are not authorized to access directly, the user can cause those indices' configured ingest pipelines to execute and return their ou

CVE-2024-23451 [MEDIUM] CWE-863 CVE-2024-23451: Incorrect Authorization issue exists in the API key based security model for Remote Cluster Security Incorrect Authorization issue exists in the API key based security model for Remote Cluster Security, which is currently in Beta, in Elasticsearch 8.10.0 and before 8.13.0. This allows a malicious user with a valid API key for a remote cluster configured to use the new Remote Cluster Security to read arbitrary documents from any index on the remote

CVE-2023-46674 [HIGH] CWE-502 CVE-2023-46674: An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon Web Services for reporting this issue.

CVE-2023-46673 [HIGH] CWE-755 CVE-2023-46673: It was identified that malformed scripts used in the script processor of an Ingest Pipeline could ca It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulate Pipeline API.

CVE-2024-23444 [HIGH] CWE-311 CVE-2024-23444: It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command invocation.

CVE-2026-72683 [MEDIUM] CWE-674 CVE-2026-72683: A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simu A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-ingest-simulate) to submit a request that causes a self-referential data structure to be created. When a specific internal component later processes that

CVE-2026-103006 [MEDIUM] CWE-674 CVE-2026-103006: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially craf Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggregation processing. An authenticated user with read access to a single index can submit a

CVE-2026-72686 [MEDIUM] CWE-674 CVE-2026-72686: A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request contai A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a recursive routine and applies no bound to the length of the value being validated, so the validation causes the thread to exhaust its stack. The resulting fa

CVE-2026-72678 [MEDIUM] CWE-789 CVE-2026-72678: Elasticsearch does not validate a size value taken from a user-supplied input before that value is u Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read privileges can submit a single small crafted request to a product API endpoint that causes the node to attempt an excessively large allocation. The resulting

CVE-2026-103008 [MEDIUM] CWE-674 CVE-2026-103008: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially craf Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains an uncontrolled recursion weakness in how it builds and serializes geometry values produced by script

CVE-2018-17244 [MEDIUM] CWE-362 CVE-2018-17244: Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are appli Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Native, or File realms. A request may receive headers intended for another request if the same username is being authenticated concurrently; when used with run as, this can result in the request ru

CVE-2024-12539 [MEDIUM] CWE-863 CVE-2024-12539: An issue was discovered where improper authorization controls affected certain queries that could al An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security in Elasticsearch and get access to documents that their roles would normally not allow.

CVE-2024-23445 [MEDIUM] CWE-922 CVE-2024-23445: It was identified that if a cross-cluster API key https://www.elastic.co/guide/en/elasticsearch/ref It was identified that if a cross-cluster API key https://www.elastic.co/guide/en/elasticsearch/reference/8.14/security-api-create-cross-cluster-api-key.html#security-api-create-cross-cluster-api-key-request-body restricts search for a given index using the query or the field_security parameter, and the same cross-cluster API key also grants replicat

CVE-2026-72687 [MEDIUM] CWE-789 CVE-2026-72687: A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deserializes the identifier before confirming that it was legitimately issued by the cluster, and a size value carried inside the identifier drives an allocation that is neither capped no

CVE-2026-72684 [MEDIUM] CWE-770 CVE-2026-72684: A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific internal component to allocate memory without any upper bound, and the allocation occurs outside the scope of the existing memory accounting controls that

CVE-2026-72639 [MEDIUM] CWE-789 CVE-2026-72639: Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highligh Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit breaker. An authenticated user holding only read privileges on a single searchable index can submit one small search request that causes the node to reserve a

CVE-2026-63140 [MEDIUM] CWE-617 CVE-2026-63140: Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipula Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null value in a specific query clause causes an internal assertion to be raised during query parsing. Because Elasticsearch treats assertion failures as fatal errors, this terminates th

CVE-2026-72636 [MEDIUM] CWE-674 CVE-2026-72636: Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The matcher used to resolve wildcard patterns against names is implemented recursively and had no bound on recursion depth or on the total number of match operations performed. A search request containin