Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of cross-cluster search requests made through the Remote Cluster Security (RCS) 2.0 model. An authorization check validates a request against one identifying attribute of the target shard, while a separate, independently-supplied identifying attribute in the same request determines which shard is actually accessed. A holder of a cross-cluster API key authorized for one index can craft a request whose two identifying attributes refer to different indices, causing the request to be authorized against an index they can access while actually operating against a different, unauthorized index. This can expose that index's document contents, field mappings, and other metadata, and in limited cases allows modification of retention-lease state on the unauthorized index.
References
| Link | Resource |
|---|---|
| https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-199/390874 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
09 Oct 2026, 13:13
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Elastic elasticsearch
Elastic |
|
| References | () https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-199/390874 - Vendor Advisory | |
| CPE | cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:* |
06 Oct 2026, 20:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-06 20:17
Updated : 2026-10-09 13:13
NVD link : CVE-2026-103009
Mitre link : CVE-2026-103009
CVE.ORG link : CVE-2026-103009
JSON object : View
Products Affected
elastic
- elasticsearch
CWE
CWE-639
Authorization Bypass Through User-Controlled Key