CVE-2026-90446

Received Received - Intake

API Path Traversal in Elasticsearch Data Store

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: ICS-CERT

Description

An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and analytics data store, without restricting its contents. This allows an authenticated attacker to substitute an arbitrary backend path, causing the application's own elevated service credentials to be used against unintended internal endpoints. This could allow an attacker to enumerate or read internal configuration and administrative data from the backend data store that would otherwise be restricted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-90446

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability involves an API endpoint that takes a user-provided value and inserts it directly into a backend request path without validation. An authenticated attacker can manipulate this value to access unintended internal endpoints using the application's elevated credentials, potentially exposing restricted backend data.

Detection Guidance

Detecting this vulnerability requires monitoring API requests for path manipulation attempts. Check logs for unusual backend path requests or responses containing internal data. Use network traffic analysis tools like tcpdump or Wireshark to inspect API traffic for path traversal patterns. Test with crafted requests to see if backend paths can be altered.

Impact Analysis

An attacker could read sensitive internal configuration or administrative data from the backend data store that should be restricted. This may lead to unauthorized access to confidential information, system settings, or other protected resources.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR and HIPAA. Exposure of internal configuration or administrative data could result in data breaches, triggering legal and regulatory penalties for non-compliance with data protection standards.

Mitigation Strategies

Validate and sanitize all user-supplied inputs to the API endpoint to ensure they do not contain path traversal characters or arbitrary backend paths. Implement strict allowlists for acceptable input values and reject any input that does not conform.

Hi! I’m here to help you understand CVE-2026-90446. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70