CVE-2026-103009

Awaiting Analysis Awaiting Analysis - Queue

Authorization Bypass in Elasticsearch via Cross-Cluster Search

Publication date: 2026-10-06

Last updated on: 2026-10-09

Assigner: Elastic

Description

Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of cross-cluster search requests made through the Remote Cluster Security (RCS) 2.0 model. An authorization check validates a request against one identifying attribute of the target shard, while a separate, independently-supplied identifying attribute in the same request determines which shard is actually accessed. A holder of a cross-cluster API key authorized for one index can craft a request whose two identifying attributes refer to different indices, causing the request to be authorized against an index they can access while actually operating against a different, unauthorized index. This can expose that index's document contents, field mappings, and other metadata, and in limited cases allows modification of retention-lease state on the unauthorized index.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103009

EUVD

EUVD-2026-93939

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	From 9.5.0 (inc) to 9.5.5 (exc)
elastic	elasticsearch	From 9.0.0 (inc) to 9.4.8 (exc)
elastic	elasticsearch	From 8.13.0 (inc) to 8.19.23 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch. It allows an attacker with a cross-cluster API key for one index to craft a request that accesses a different, unauthorized index by manipulating shard identifiers. The system checks authorization against one attribute but uses another to determine the actual shard accessed, leading to information disclosure.

Detection Guidance

Detection requires reviewing Elasticsearch logs for unusual cross-cluster search requests that reference mismatched shard identifiers. Check for requests where the authorized index does not match the accessed index. Enable verbose logging for cross-cluster search operations to identify anomalies.

Impact Analysis

This vulnerability can expose sensitive data such as document contents, field mappings, and metadata from unauthorized indices. In limited cases, it may also allow modification of retention-lease state on the unauthorized index. The impact includes potential data breaches and unauthorized access to confidential information.

Compliance Impact

This vulnerability can lead to non-compliance with data protection regulations like GDPR and HIPAA by enabling unauthorized access to sensitive personal or health information. Organizations may face legal penalties, reputational damage, and loss of customer trust due to data breaches resulting from this issue.

Mitigation Strategies

Upgrade Elasticsearch to a patched version that fixes the authorization bypass in cross-cluster search requests. Review and restrict cross-cluster API keys to ensure they only grant access to authorized indices. Monitor for unusual cross-cluster search requests that may indicate exploitation attempts.

Hi! I’m here to help you understand CVE-2026-103009. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70