Elasticsearch vulnerabilities

The snapshot API in Elasticsearch before version 1.6.0 is vulnerable when another application exists on the system that can read Lucene files and execute code from them. This allows remote authenticated users to write to and create arbitrary snapshot metadata files, potentially executing arbitrary code.

Elasticsearch contains an authorization bypass vulnerability in the Remote Cluster Security (RCS) 2.0 model. An attacker with a valid API key can send a specially crafted cross-cluster search request that is authorized for one index but actually operates on a different, unauthorized index, exposing its data.

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains this weakness in how it builds and serializes geometry values produced by scripted runtime fields. An authenticated user with read access to a single index can submit a request defining such a field with a script that produces a deeply nested structure, causing the affected node to terminate. The node does not recover automatically on all deployments and may require manual intervention.

Elasticsearch contains an incorrect authorization vulnerability in a configurable, non-default privilege that allows an administrator to delegate limited role-management capability. Due to incomplete enforcement of scope, a user with this privilege can expand their access to indices that should remain restricted, including internal security data.

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains this weakness in its search aggregation processing. An authenticated user with read access to a single index can submit a crafted request containing deeply nested aggregation definitions, triggering unbounded recursive execution that exhausts the server process's resources and causes the affected node to terminate. The node does not recover automatically and requires manual intervention.

Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges could cause the cluster to allocate an uncontrolled amount of memory when connector resources with an excessively large `description` field are created and subsequently accessed, exhausting available heap memory and crashing the affected node.

Elasticsearch does not limit total memory used when retrieving multiple index templates, despite per-resource limits. A user with manage_index_templates privilege can register many templates, and retrieving them together exhausts heap memory, causing node failure and denial of service.

Uncontrolled recursion in Elasticsearch allows an authenticated low-privileged user to terminate an Elasticsearch node, resulting in denial of service. The vulnerability is related to excessive resource allocation.

Inefficient regular expression complexity in Elasticsearch's ES|QL CHUNK function can lead to denial of service via catastrophic backtracking. A user with read access to a text-based index can submit a crafted regex causing excessive CPU consumption and degrading query throughput for other tenants.

Incorrect authorization in Elasticsearch allows an authenticated user with privileges over a single resource to modify a data stream they are not authorized for. This can allow data injection or affect searchability, but does not enable reading the stream's contents.

Uncontrolled resource consumption in Elasticsearch allows a low-privileged user to crash a node with a crafted query causing uncontrolled memory growth. The condition can be triggered repeatedly, including via queries in shared resources, causing persistent cluster unavailability.

Uncontrolled resource consumption (CWE-400) in Elasticsearch can lead to denial of service via excessive allocation (CAPEC-130).

Uncontrolled resource consumption (CWE-400) in Elasticsearch can lead to denial of service via excessive allocation (CAPEC-130).

Uncontrolled resource consumption (CWE-400) in Elasticsearch can lead to denial of service via excessive allocation (CAPEC-130).

Uncontrolled resource consumption (CWE-400) in Elasticsearch can lead to denial of service via excessive allocation (CAPEC-130).

Uncontrolled resource consumption (CWE-400) in Elasticsearch can lead to denial of service via excessive allocation (CAPEC-130).

Uncontrolled resource consumption (CWE-400) in Elasticsearch can lead to denial of service via excessive allocation (CAPEC-130).

Uncontrolled resource consumption (CWE-400) in Elasticsearch can lead to denial of service via excessive allocation (CAPEC-130).

Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause administrator-provisioned credentials to be exposed.

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33). Under specific proxy deployment configurations, a network attacker could obtain confidential responses intended for other authenticated users.

Deserialization of untrusted data in Elasticsearch machine learning component can lead to remote code execution via object injection. A crafted trained model artifact could execute attacker-controlled logic with broader system-call surface. Requires authenticated user with privileges to create and deploy models.

A vulnerability in Elasticsearch allows a user with elevated privileges to submit a specially crafted request that causes excessive memory consumption, potentially making the affected node unavailable.

A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deserializes the identifier before confirming that it was legitimately issued by the cluster, and a size value carried inside the identifier drives an allocation that is neither capped nor accounted for by the available memory-usage controls. The resulting out-of-memory condition is fatal and terminates the affected node process, resulting in a denial of service.

A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a recursive routine and applies no bound to the length of the value being validated, so the validation causes the thread to exhaust its stack. The resulting fatal error is not handled by the surrounding execution paths and terminates the affected node process, producing a denial of service.

A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document occupies a worker thread from a bounded pool for a disproportionate amount of time, degrading the availability of indexing operations on the affected node.

A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific internal component to allocate memory without any upper bound, and the allocation occurs outside the scope of the existing memory accounting controls that were intended to constrain it. The resulting out-of-memory condition is fatal and terminates the affected node process, causing a denial of service.

A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint to submit a request that causes a self-referential data structure to be created. When a specific internal component later processes that structure, the operation recurses without bound and raises a fatal error that is not handled by the surrounding execution path, terminating the affected node process and resulting in a denial of service.

Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pattern drives unbounded recursion that exhausts the thread stack and raises a fatal error, terminating the Elasticsearch node process and causing a denial of service for that node. An authenticated user holding only read-only privileges on a single searchable index can trigger the condition with one small search request.

Elasticsearch does not validate a size value from user input before using it to reserve memory for an internal data structure. An authenticated user with read-only privileges can send a single crafted request causing an excessively large allocation. Memory exhaustion raises a fatal error that terminates the node process, causing denial of service and degrading cluster health.

Memory allocation with excessive size in ES|QL query processing of Elasticsearch can lead to denial of service. An authenticated user can submit a specially crafted query whose evaluation allocates unbounded heap memory, exhausting available heap on the receiving node and causing the node to become unavailable.

Uncontrolled recursion in Elasticsearch can lead to denial of service. An authenticated user with read-only privileges on a single index can submit one specially crafted search request whose deeply nested structure is processed without a depth limit, exhausting the thread stack and terminating the affected node.

A vulnerability in Elasticsearch allows an authenticated user with read-only privileges on a single index to submit one small, specially crafted search request that causes excessive memory allocation, exhausting the JVM heap and terminating the affected node.

The native inference process in Elasticsearch for evaluating uploaded ML models accepts a model operation that computes a memory address from an offset without validating bounds. A user with privileges to upload and deploy models can craft a model that reads/writes memory outside the intended allocation.

Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit breaker. An authenticated user with read-only privileges on a single searchable index can submit one small search request that causes the node to reserve an excessively large internal data structure. The allocation occurs before the existing highlighting safety limits are evaluated, so memory exhaustion raises a fatal error that terminates the Elasticsearch node process. This results in a denial of service for the affected node and degrades cluster routing and health. The defect is not volumetric and does not depend on the size of the indexed data, so a single request is sufficient.

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user with low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analysis definition that is resolved recursively without a cycle or depth check, exhausting the thread stack and terminating the affected node.

Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The matcher used to resolve wildcard patterns against names is implemented recursively and had no bound on recursion depth or on the total number of match operations performed. A search request containing a wildcard pattern with a large number of wildcard groups, evaluated against a sufficiently long name, exhausts the thread stack. Elasticsearch treats a stack overflow as an unrecoverable condition and shuts the node down, so the request terminates the affected node rather than failing gracefully.

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Resource exhaustion persists beyond query completion, and repeated requests can fully exhaust available query worker resources, rendering ES|QL queries unavailable until the node is restarted.

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch query evaluation component, causing a fatal error that terminates the affected node. In single-node deployments, this results in complete service outage; in multi-node clusters, it causes repeated node restarts and sustained availability degradation.

Vulnerability in Elasticsearch (CWE-617) leading to denial of service via input data manipulation. A low-privileged authenticated user can send a crafted search request causing an assertion and node process termination.

Vulnerability in Elasticsearch (CWE-400) leading to denial of service via excessive memory allocation. A user with search privileges can send a crafted search request causing data node heap exhaustion.

A vulnerability in Elasticsearch allows an authenticated low-privileged user to execute a specially crafted EQL query that causes excessive memory consumption and crashes the Elasticsearch node.

Incorrect Authorization (CWE-863) vulnerability in Elasticsearch. An authenticated user with limited index privileges can exploit insufficient authorization controls in the ingest simulation feature. By targeting indices they are not authorized to access directly, the user can cause those indices' configured ingest pipelines to execute and return their output, potentially disclosing data processed or enriched by those pipelines. Additionally, the same feature can be used to retrieve index mapping metadata for indices the user are not authorized to access directly.

CVE-2026-49090 in Elasticsearch allows a denial of service (DoS) via uncontrolled resource consumption. An authenticated user can submit a specially crafted bulk request causing sustained high CPU usage, rendering the affected node unable to process requests.

CWE-770 vulnerability in Elasticsearch allows a denial of service via excessive memory allocation. A privileged user can submit a crafted machine learning request, causing resource exhaustion and node unavailability.

CVE-2026-56148 in Elasticsearch involves uncontrolled recursion leading to denial of service. An authenticated user can submit a specially crafted query causing excessive resource consumption during processing, potentially rendering the affected node unavailable.

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized user settings data.

Improper authentication in the Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. An attacker would need such a certificate signed by a trusted CA.

Elasticsearch inserts sensitive information into log files when auditing requests to the reindex API. Under specific preconditions, this can lead to a loss of confidentiality.