CVE catalog
CVE-2026-103009
Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shar
- Severity
- High · CVSS 7.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.23% · Oct 25, 2026
A flaw was found in Elasticsearch. When processing cross-cluster search requests under the Remote Cluster Security (RCS) model, the service validates permissions using one target identifier while retrieving data using a separate identifier. An authenticated attacker possessing a valid cross-cluster API key can exploit this inconsistency by sending a crafted request with mismatched identifiers to bypass access controls. This flaw allows unauthorized information disclosure, exposing document contents, field mappings, and metadata, and may allow limited modification of retention lease states. elasticsearch: Elasticsearch: Information disclosure via crafted cross-cluster search requests The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | elasticsearch | Not reported | 9.5.5 | fixed |
| Bitnami | elasticsearch | Not reported | 8.19.23 | fixed |
| Bitnami | elasticsearch | Not reported | 9.4.8 | fixed |
| Bitnami | elasticsearch | Not reported | 9.5.5 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | elasticsearch | cpe | Not reported | 9.5.5 | Not reported | NVD-CVE-2026-103009 | Not reported |
| Bitnami | elasticsearch | Bitnami | Not reported | 8.19.23 | Not reported | BIT-ELASTICSEARCH-2026-103009 | Not reported |
| Bitnami | elasticsearch | Bitnami | Not reported | 9.4.8 | Not reported | BIT-ELASTICSEARCH-2026-103009 | Not reported |
| Bitnami | elasticsearch | Bitnami | Not reported | 9.5.5 | Not reported | BIT-ELASTICSEARCH-2026-103009 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed:
References
- [https://nvd.nist.gov/vuln/detail/CVE-2026-103009]
- [https://osv.dev/vulnerability/BIT-elasticsearch-2026-103009]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103009.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3784.json]
[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]