Elasticsearch 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-209)

Announcements Security Announcements
1

Incorrect Authorization in Elasticsearch Leading to Information Disclosure

Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user whose index access is restricted by field-level security can retrieve the value of a constant_keyword field that their role excludes. Some search and query features do not apply the field-level security restriction to this field type.

Affected Versions:

  • 8.x: All versions from 8.0.0 up to and including 8.19.23
  • 9.x:
  • All versions from 9.0.0 up to and including 9.4.8
  • All versions from 9.5.0 up to and including 9.5.5

Affected Configurations:

  • Deployments that use field-level security to hide constant_keyword fields from some users. Deployments that do not use field-level security, and indices that do not have a constant_keyword field excluded by field-level security, are not affected.

Solutions and Mitigations:

The issue is resolved in versions 8.19.24, 9.4.9, and 9.5.6.

The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the known issues for your target version before upgrading.

For Users that Cannot Upgrade:

  • Self-hosted and Cloud: Do not rely on field-level security to hide constant_keyword values. Keep sensitive constant_keyword values out of indices that users with field-level security restrictions can read, or move that data to indices that those users cannot access.

Indicators of Compromise (IOC)

No specific indicators of compromise have been identified for this vulnerability.

Elastic Cloud Serverless

Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.

Severity: CVSSv3.1: Medium ( 4.3 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVE ID: CVE-2026-115298
Problem Type: CWE-863 - Incorrect Authorization
Impact: CAPEC-1 - Accessing Functionality Not Properly Constrained by ACLs