CVE-2026-103007

[CVE catalog]

Severity

High · CVSS 7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Published

Oct 6, 2026, 7:31:50 PM UTC

Updated

Oct 6, 2026, 8:17:13 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.34% · Oct 25, 2026

A flaw was found in Elasticsearch. An authorization flaw in delegated role-management permissions allows an authenticated user with delegated administrative access to escalate privileges. Because authorization checks fail to strictly enforce index scoping restrictions, a user with this privilege can modify their assigned role to access restricted data, potentially gaining full administrative control of the cluster. elasticsearch: Elasticsearch: Privilege escalation via improper enforcement of delegated role permissions An IMPORTANT severity incorrect authorization flaw was found in Elasticsearch. The issue affects deployments that use the configurable, non-default delegated role-management privilege, which lets an administrator delegate limited role-management capability to another user scoped to specific indices. The authorization check that enforces this scoping does not correctly account for a role-definition setting that can expand the matched index set, so an authenticated user holding this delegated privilege with a broadly-scoped index pattern (for example wildcards or regular expressions that can match restricted or system indices) can update their own assigned role to gain access to indices that should remain restricted, including internal security data, potentially escalating to full administrative control of the cluster. Deployments that do not use this feature, or that scope the privilege only to literal index names, are not affected. The Red Hat CVSS score (7.2, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) is the same as the upstream Elastic score, and no Red Hat-branded products are affected; the affected scope is limited to community Elasticsearch-related packages in Fedora and EPEL, for which the fix is being pursued through the upstream community process (DELEGATED). The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.