CVE-2026-94408

The snapshot API in Elasticsearch before version 1.6.0 is vulnerable when another application exists on the system that can read Lucene files and execute code from them. This allows remote authenticated users to write to and create arbitrary snapshot metadata files, potentially executing arbitrary code.

Elasticsearch contains an authorization bypass vulnerability in the Remote Cluster Security (RCS) 2.0 model. An attacker with a valid API key can send a specially crafted cross-cluster search request that is authorized for one index but actually operates on a different, unauthorized index, exposing its data.

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains this weakness in how it builds and serializes geometry values produced by scripted runtime fields. An authenticated user with read access to a single index can submit a request defining such a field with a script that produces a deeply nested structure, causing the affected node to terminate. The node does not recover automatically on all deployments and may require manual intervention.

Elasticsearch contains an incorrect authorization vulnerability in a configurable, non-default privilege that allows an administrator to delegate limited role-management capability. Due to incomplete enforcement of scope, a user with this privilege can expand their access to indices that should remain restricted, including internal security data.

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains this weakness in its search aggregation processing. An authenticated user with read access to a single index can submit a crafted request containing deeply nested aggregation definitions, triggering unbounded recursive execution that exhausts the server process's resources and causes the affected node to terminate. The node does not recover automatically and requires manual intervention.

Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges could cause the cluster to allocate an uncontrolled amount of memory when connector resources with an excessively large `description` field are created and subsequently accessed, exhausting available heap memory and crashing the affected node.

Elasticsearch does not limit total memory used when retrieving multiple index templates, despite per-resource limits. A user with manage_index_templates privilege can register many templates, and retrieving them together exhausts heap memory, causing node failure and denial of service.

Uncontrolled recursion in Elasticsearch allows an authenticated low-privileged user to terminate an Elasticsearch node, resulting in denial of service. The vulnerability is related to excessive resource allocation.

Inefficient regular expression complexity in Elasticsearch's ES|QL CHUNK function can lead to denial of service via catastrophic backtracking. A user with read access to a text-based index can submit a crafted regex causing excessive CPU consumption and degrading query throughput for other tenants.

Incorrect authorization in Elasticsearch allows an authenticated user with privileges over a single resource to modify a data stream they are not authorized for. This can allow data injection or affect searchability, but does not enable reading the stream's contents.