CVE-2026-103009— Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure
Quick assessment
Affected
Elastic Elasticsearch
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Elasticsearch 中存在通过用户可控键绕过授权（CWE-639）的漏洞，攻击者可通过构造特制的跨集群搜索请求，引用未授权的片段（shard）标识符，从而导致信息泄露。 在通过远程集群安全（RCS）2.0 模型发起的跨集群搜索请求处理过程中，Elasticsearch 存在授权绕过弱点。授权检查机制基于目标片段的某个识别属性对请求进行验证，而同一请求中另一个独立提供的识别属性则决定实际访问的是哪个片段。持有跨集群 API 密钥且被授权访问某个索引的用户，可以构造一个请求，使其两个识别属性分别指向不同的索引：
Possible ATT&CK Techniques 3 AI
T1078 · Valid Accounts T1528 · Steal Application Access Token T1530 · Data from Cloud StorageAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Elastic | Elasticsearch | 8.13.0≤ 8.19.22 |
affected |
9.0.0≤ 9.4.7 |
affected | ||
9.5.0≤ 9.5.4 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-103009
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure
Source: CVE Program / CVE List V5
Vulnerability Description
Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of cross-cluster search requests made through the Remote Cluster Security (RCS) 2.0 model. An authorization check validates a request against one identifying attribute of the target shard, while a separate, independently-supplied identifying attribute in the same request determines which shard is actually accessed. A holder of a cross-cluster API key authorized for one index can craft a request whose two identifying attributes refer to different indices, causing the request to be authorized against an index they can access while actually operating against a different, unauthorized index. This can expose that index's document contents, field mappings, and other metadata, and in limited cases allows modification of retention-lease state on the unauthorized index.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Elastic | Elasticsearch | 8.13.0 ~ 8.19.22 | - |
|
II. Public POCs for CVE-2026-103009
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-103009
请登录查看更多情报信息。
Other References for CVE-2026-103009 (1)
Same Patch Batch · Elastic · 2026-10-06 · 14 CVEs total
| CVE-2026-102406 | 8.8 HIGH | Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data In |
| CVE-2026-103007 | 7.2 HIGH | Incorrect Authorization in Elasticsearch Leading to Privilege Escalation |
| CVE-2026-102412 | 6.5 MEDIUM | Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure |
| CVE-2026-102409 | 6.5 MEDIUM | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service |
| CVE-2026-102411 | 6.5 MEDIUM | Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of |
| CVE-2026-102404 | 6.5 MEDIUM | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service |
| CVE-2026-103008 | 6.5 MEDIUM | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service |
| CVE-2026-103005 | 6.5 MEDIUM | Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service |
| CVE-2026-103006 | 6.5 MEDIUM | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service |
| CVE-2026-102413 | 6.2 MEDIUM | Uncaught Exception in Elastic Endpoint Leading to Denial of Service |
| CVE-2026-102407 | 5.4 MEDIUM | Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification |
| CVE-2026-102410 | 4.3 MEDIUM | Missing Authorization in Kibana Leading to Information Disclosure |
| CVE-2026-102408 | 4.3 MEDIUM | Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service |
IV. Related Vulnerabilities
Same product: Elasticsearch
-
CVE-2026-103008
Uncontrolled Recursion in Elasticsearch Leading to Denial of -
CVE-2026-103007
Incorrect Authorization in Elasticsearch Leading to Privileg -
CVE-2026-103006
Uncontrolled Recursion in Elasticsearch Leading to Denial of -
CVE-2026-103005
Memory Allocation with Excessive Size Value in Elasticsearch -
CVE-2026-102411
Allocation of Resources Without Limits or Throttling in Elas
Same vendor: Elastic
-
CVE-2026-103008
Uncontrolled Recursion in Elasticsearch Leading to Denial of -
CVE-2026-103007
Incorrect Authorization in Elasticsearch Leading to Privileg -
CVE-2026-103006
Uncontrolled Recursion in Elasticsearch Leading to Denial of -
CVE-2026-103005
Memory Allocation with Excessive Size Value in Elasticsearch -
CVE-2026-102413
Uncaught Exception in Elastic Endpoint Leading to Denial of
Same weakness: CWE-639
-
CVE-2026-105811
Authorization bypass through a user-controlled key in the Am -
CVE-2026-102157
Security Advisory 0190 -
CVE-2026-102406
Authorization Bypass Through User-Controlled Key in Kibana L -
CVE-2026-106100
Payload: Field-level write access bypass in Payload on Mongo -
CVE-2026-105867
Payload: Client uploads could overwrite S3 objects
V. Comments for CVE-2026-103009
No comments yet