Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-115710— Use of Cache Containing Sensitive Information in Elasticsearch Leading to Information Disclosure

Quick assessment

Affected

Elastic Elasticsearch

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Elasticsearch 中存在“包含敏感信息的缓存使用”漏洞（CWE-524）。攻击者可通过精心构造的搜索请求，导致信息泄露和搜索结果错误。对于某些查询类型，Elasticsearch 可能在受字段级安全限制的用户与不受限制的用户之间共享缓存的查询结果。受字段级安全限制的用户可借此推断出与其不可读字段中某值相匹配的文档；此外，受限用户还可导致拥有完全访问权限的用户收到不完整的搜索结果。此类信息泄露仅在拥有完全访问权限的用户近期在同一分片上执行过相同查询时才会发生。

CVSS 4.2 · Medium Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1040 · Network Sniffing T1190 · Exploit Public-Facing Application

Affected Version Matrix 3

Vendor	Product	Version Range	Status
Elastic	Elasticsearch	`8.9.0≤ 8.19.23`	affected
		`9.0.0≤ 9.4.8`	affected
		`9.5.0≤ 9.5.5`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Use of Cache Containing Sensitive Information in Elasticsearch Leading to Information Disclosure

Source: CVE Program / CVE List V5

Vulnerability Description

Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and incorrect search results via specially crafted search requests. For some query types, Elasticsearch can share cached query results between users who have field-level security restrictions and users who do not. A user restricted by field-level security can learn which documents match a value in a field that they cannot read. A restricted user can also cause users with full access to receive incomplete search results. Disclosure is only possible when a user with full access ran the same query on the same shard recently.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

通过缓存导致的信息暴露

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Elastic	Elasticsearch	8.9.0 ~ 8.19.23	-

II. Public POCs for CVE-2026-115710

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-115710

请登录查看更多情报信息。

Other References for CVE-2026-115710 (1)

https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-210/391363

https://www.cve.org/CVERecord?id=CVE-2026-115710

Same Patch Batch · Elastic · 2026-11-03 · 12 CVEs total

CVE-2026-115290	7.5 HIGH	Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
CVE-2026-115714	7.4 HIGH	Improper Certificate Validation in Elastic Docker Images Leading to Interception of TLS Co
CVE-2026-115294	7.3 HIGH	Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthori
CVE-2026-115297	6.5 MEDIUM	NULL Pointer Dereference in Packetbeat Leading to Denial of Service
CVE-2026-115715	6.5 MEDIUM	Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of
CVE-2026-115293	6.5 MEDIUM	Insertion of Sensitive Information Into Sent Data in Kibana Leading to Credential Disclosu
CVE-2026-115716	6.5 MEDIUM	Allocation of Resources Without Limits or Throttling in APM Server Leading to Denial of Se
CVE-2026-115298	4.3 MEDIUM	Incorrect Authorization in Elasticsearch Leading to Information Disclosure
CVE-2026-115295	4.3 MEDIUM	Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosu
CVE-2026-115292	4.3 MEDIUM	Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosu
CVE-2026-115289	4.3 MEDIUM	Use of Multiple Resources with Duplicate Identifier in APM Server Leading to Information D

IV. Related Vulnerabilities

Same product: Elasticsearch

Same vendor: Elastic

Same weakness: CWE-524