Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution
Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface than intended. Exploitation requires an authenticated user with sufficient privileges to create and deploy trained models.
Affected Versions:
- 8.x: All versions from 8.0.0 up to and including 8.19.19
- 9.x:
- All versions from 9.0.0 up to and including 9.4.4
- Version 9.5.0
Affected Configurations:
- Exploitation requires an account that is authorized to create trained models, upload their definitions, and start a model deployment.
- Clusters with no machine learning capacity, or where machine learning is disabled, are not affected.
Solutions and Mitigations:
The issue is resolved in Elasticsearch versions 8.19.20, 9.4.5, and 9.5.1.
For Users that Cannot Upgrade:
Self-Managed
Disable machine learning cluster-wide by setting xpack.ml.enabled: false in elasticsearch.yml on all nodes and restarting the cluster. Third-party trained models should not be uploaded to a cluster running an affected version.
Cloud
Machine learning capacity can be removed from Elastic Cloud Hosted deployments from the deployment configuration screen. Third-party trained models should not be uploaded to a deployment running an affected version.
Indicators of Compromise (IOC)
Review the trained models present in the cluster and their deployments. A trained model that your organization did not upload, or a model definition originating from an untrusted third-party source, is an indicator that this issue may have been exploited.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: High ( 8.8 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE ID: CVE-2026-72649
Problem Type: CWE-502 - Deserialization of Untrusted Data
Impact: CAPEC-586 - Object Injection