Use of Cache Containing Sensitive Information in Elasticsearch Leading to Information Disclosure
Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and incorrect search results via specially crafted search requests. For some query types, Elasticsearch can share cached query results between users who have field-level security restrictions and users who do not. A user restricted by field-level security can learn which documents match a value in a field that they cannot read. A restricted user can also cause users with full access to receive incomplete search results. Disclosure is only possible when a user with full access ran the same query on the same shard recently.
Affected Versions:
- 8.x: All versions from 8.9.0 up to and including 8.19.23
- 9.x:
- All versions from 9.0.0 up to and including 9.4.8
- All versions from 9.5.0 up to and including 9.5.5
Affected Configurations:
- Deployments that use field-level security, where users with field-level security restrictions and users without these restrictions search the same indices. Deployments that do not use field-level security are not affected.
Solutions and Mitigations:
The issue is resolved in versions 8.19.24, 9.4.9, and 9.5.6.
The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the known issues for your target version before upgrading.
For Users that Cannot Upgrade:
- Self-hosted and Cloud: Disable the query cache on indices that users with field-level security restrictions can search. To do this, set the index.queries.cache.enabled index setting to false. This is a static setting, so you can only change it when you create the index or when the index is closed. Disabling the query cache can decrease search performance.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: Medium ( 4.2 ) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CVE ID: CVE-2026-115710
Problem Type: CWE-524 - Use of Cache Containing Sensitive Information