Missing Authorization in Elasticsearch Leading to Information Disclosure
Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause administrator-provisioned credentials to be exposed.
Affected Versions:
- 8.x: All versions from 8.0.0 up to and including 8.19.18
- 9.x:
- All versions from 9.0.0 up to and including 9.3.7
- All versions from 9.4.0 up to and including 9.4.3
- Version 9.5.0
Affected Configurations:
Deployments using the custom inference service type with secret-backed configuration, where users are granted inference execution privileges.
Solutions and Mitigations:
The issue is resolved in Elasticsearch versions 8.19.19, 9.3.8, 9.4.4, and 9.5.1.
For Users that Cannot Upgrade:
There are no workarounds for this vulnerability.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: Medium ( 5.4 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVE ID: CVE-2026-78607
Problem Type: CWE-862 - Missing Authorization
Impact: CAPEC-122 - Privilege Abuse