CVE-2026-56144
Received Received - Intake

Incorrect Authorization in Elasticsearch Ingest Simulation

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Elastic

Description
Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature. By targeting indices they are not authorized to access directly, the user can cause those indices' configured ingest pipelines to execute and return their output, potentially disclosing data processed or enriched by those pipelines. Additionally, the same feature can be used to retrieve index mapping metadata for indices the user are not authorized to access directly.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-22
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-56144

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
elastic elasticsearch *
elastic elasticsearch to 8.19.18 (exc)
elastic elasticsearch to 9.3.7 (exc)
elastic elasticsearch to 9.4.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-56144 is an Incorrect Authorization vulnerability in Elasticsearch where an authenticated user with limited privileges can exploit weak authorization controls in the ingest simulation feature. This allows them to target indices they are not authorized to access directly, execute ingest pipelines on those indices, and retrieve their output or mapping metadata, potentially disclosing sensitive data.

Detection Guidance

To detect CVE-2026-56144, check Elasticsearch versions for affected releases (8.19.17 and earlier, 9.3.6 and earlier, or 9.4.3 and earlier). Verify if ingest pipelines exist on restricted indices and test unauthorized access attempts via the ingest simulation feature.

Impact Analysis

This vulnerability can impact you by allowing unauthorized users to access sensitive data processed or enriched by ingest pipelines on restricted indices. It may also expose index mapping metadata, leading to further exploitation or data leakage. The impact depends on the sensitivity of the data in those indices.

Compliance Impact

This vulnerability can lead to unauthorized data access, which may violate compliance requirements under GDPR, HIPAA, or other regulations. It risks exposing personal or sensitive data, potentially resulting in legal penalties, reputational damage, and loss of trust due to non-compliance with data protection standards.

Mitigation Strategies

Upgrade Elasticsearch to fixed versions: 8.19.18, 9.3.7, or 9.4.4. If upgrading is not possible, restrict access to the ingest simulation API and disable ingest pipelines on sensitive indices until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56144. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart