CVE-2026-115715

The snapshot API in Elasticsearch before version 1.6.0 is vulnerable when another application exists on the system that can read Lucene files and execute code from them. This allows remote authenticated users to write to and create arbitrary snapshot metadata files, potentially executing arbitrary code.

Elasticsearch has a CWE-524 (use of cache containing sensitive information) vulnerability enabling information disclosure and incorrect search results via specially crafted search requests. For some query types, Elasticsearch can share cached query results between users with field-level security restrictions and users without them.

Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user whose index access is restricted by field-level security can retrieve the value of a constant_keyword field that their role excludes. Some search and query features do not apply the field-level security restriction to this field type.

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads. An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate.

Elasticsearch contains an authorization bypass vulnerability in the Remote Cluster Security (RCS) 2.0 model. An attacker with a valid API key can send a specially crafted cross-cluster search request that is authorized for one index but actually operates on a different, unauthorized index, exposing its data.

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains this weakness in how it builds and serializes geometry values produced by scripted runtime fields. An authenticated user with read access to a single index can submit a request defining such a field with a script that produces a deeply nested structure, causing the affected node to terminate. The node does not recover automatically on all deployments and may require manual intervention.

Elasticsearch contains an incorrect authorization vulnerability in a configurable, non-default privilege that allows an administrator to delegate limited role-management capability. Due to incomplete enforcement of scope, a user with this privilege can expand their access to indices that should remain restricted, including internal security data.

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains this weakness in its search aggregation processing. An authenticated user with read access to a single index can submit a crafted request containing deeply nested aggregation definitions, triggering unbounded recursive execution that exhausts the server process's resources and causes the affected node to terminate. The node does not recover automatically and requires manual intervention.

Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges could cause the cluster to allocate an uncontrolled amount of memory when connector resources with an excessively large `description` field are created and subsequently accessed, exhausting available heap memory and crashing the affected node.

Elasticsearch does not limit total memory used when retrieving multiple index templates, despite per-resource limits. A user with manage_index_templates privilege can register many templates, and retrieving them together exhausts heap memory, causing node failure and denial of service.