# Elasticsearch 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-209)

**URL:** <https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-209/391362>\
**Category:** Security Announcements\
**Created:** [November 3, 2026, 4:29pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-209/391362 "2026-11-03T16:29:11Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bryan\_Garcia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bryan_garcia/32/148179_2.png) [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\
**Post date:** [November 3, 2026, 4:29pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-209/391362/1 "2026-11-03T16:29:11Z")

</div>

**Incorrect Authorization in Elasticsearch Leading to Information Disclosure**

Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user whose index access is restricted by field-level security can retrieve the value of a constant\_keyword field that their role excludes. Some search and query features do not apply the field-level security restriction to this field type.

**Affected Versions:**

> - 8.x: All versions from 8.0.0 up to and including 8.19.23
> - 9.x:

- All versions from 9.0.0 up to and including 9.4.8
- All versions from 9.5.0 up to and including 9.5.5

**Affected Configurations:**

> - Deployments that use field-level security to hide constant\_keyword fields from some users. Deployments that do not use field-level security, and indices that do not have a constant\_keyword field excluded by field-level security, are not affected.

**Solutions and Mitigations:**

The issue is resolved in versions 8.19.24, 9.4.9, and 9.5.6.

The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the [known issues](https://www.elastic.co/docs/release-notes) for your target version before upgrading.

**For Users that Cannot Upgrade:**

> - Self-hosted and Cloud: Do not rely on field-level security to hide constant\_keyword values. Keep sensitive constant\_keyword values out of indices that users with field-level security restrictions can read, or move that data to indices that those users cannot access.

**Indicators of Compromise (IOC)**

No specific indicators of compromise have been identified for this vulnerability.

**Elastic Cloud Serverless**

Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.

**Severity:** CVSSv3.1: Medium ( 4.3 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N  
**CVE ID:** CVE-2026-115298  
**Problem Type:** CWE-863 - Incorrect Authorization  
**Impact:** CAPEC-1 - Accessing Functionality Not Properly Constrained by ACLs