CVE-2026-78605— Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure
Quick assessment
Affected
Elastic Elasticsearch
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Elasticsearch 中存在 HTTP 请求解释不一致（CWE-444）的漏洞，即“HTTP 请求走私”（HTTP Request Smuggling）。在特定的代理部署配置下，网络攻击者可能通过 HTTP 请求走私（CAPEC-33）获取本应发送给其他已认证用户的机密响应，从而导致信息泄露。
Possible ATT&CK Techniques 2 AI
T1011 · Exfiltration Over Other Network Medium T1021 · Remote ServicesAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Elastic | Elasticsearch | 8.18.0≤ 8.19.19 |
affected |
9.0.0≤ 9.4.4 |
affected | ||
9.5.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-78605
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure
Source: CVE Program / CVE List V5
Vulnerability Description
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33). Under specific proxy deployment configurations, a network attacker could obtain confidential responses intended for other authenticated users.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
HTTP请求的解释不一致性(HTTP请求私运)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Elastic | Elasticsearch | 8.18.0 ~ 8.19.19 | - |
|
II. Public POCs for CVE-2026-78605
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-78605
请登录查看更多情报信息。
Other References for CVE-2026-78605 (1)
Same Patch Batch · Elastic · 2026-09-01 · 20 CVEs total
| CVE-2026-72649 | 8.8 HIGH | Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution |
| CVE-2026-63137 | 8.3 HIGH | Incorrect Authorization in Kibana Leading to Privilege Escalation |
| CVE-2026-78592 | 7.3 HIGH | Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthori |
| CVE-2024-14047 | 7.2 HIGH | Improper Link Resolution Before File Access ('Link Following') in Winlogbeat Leading to Ar |
| CVE-2026-78608 | 6.5 MEDIUM | Missing Authorization in Kibana Leading to Information Disclosure |
| CVE-2026-33465 | 6.5 MEDIUM | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Servic |
| CVE-2026-63138 | 6.5 MEDIUM | Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Infor |
| CVE-2026-72654 | 6.5 MEDIUM | Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure |
| CVE-2026-72628 | 6.5 MEDIUM | Improper Handling of Highly Compressed Data in Kibana Leading to Denial of Service |
| CVE-2026-72652 | 6.5 MEDIUM | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Servic |
| CVE-2026-72644 | 6.5 MEDIUM | Uncaught Exception in Kibana Leading to Denial of Service |
| CVE-2026-72682 | 6.5 MEDIUM | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Servic |
| CVE-2026-78607 | 5.4 MEDIUM | Missing Authorization in Elasticsearch Leading to Information Disclosure |
| CVE-2026-72641 | 5.4 MEDIUM | Incorrect Authorization in Kibana Leading to Unauthorized Modification of Data |
| CVE-2026-56143 | 4.9 MEDIUM | Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of |
| CVE-2026-72633 | 4.3 MEDIUM | Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitorin |
| CVE-2026-78603 | 4.3 MEDIUM | Missing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Met |
| CVE-2026-78597 | 4.3 MEDIUM | Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation |
| CVE-2026-78606 | 4.2 MEDIUM | Incorrect Authorization in Kibana Leading to Unauthorized Disclosure, Modification, and De |
IV. Related Vulnerabilities
Same product: Elasticsearch
-
CVE-2026-78607
Missing Authorization in Elasticsearch Leading to Informatio -
CVE-2026-72649
Deserialization of Untrusted Data in Elasticsearch Leading t -
CVE-2026-56143
Allocation of Resources Without Limits or Throttling in Elas -
CVE-2026-72636
Uncontrolled Recursion in Elasticsearch Wildcard Matching Le -
CVE-2026-72642
Use of Out-of-range Pointer Offset in the Elasticsearch Mach
Same vendor: Elastic
-
CVE-2026-63138
Improper Neutralization of Special Elements in Data Query Lo -
CVE-2026-78597
Missing Authorization in Kibana Entity Store Leading to Unau -
CVE-2026-78592
Improper Limitation of a Pathname to a Restricted Directory -
CVE-2026-78606
Incorrect Authorization in Kibana Leading to Unauthorized Di -
CVE-2026-78603
Missing Authorization in Kibana Leading to Unauthorized Disc
Same weakness: CWE-444
-
CVE-2026-84363
Hono: Query parser reads parameters after the URL fragment, -
CVE-2026-73812
inets, httpd: HTTP Request Smuggling via Transfer-Encoding a -
CVE-2026-73276
inets, httpd: HTTP Request Smuggling via Whitespace-Before-C -
CVE-2026-66357
inets,httpd:HTTP Request Smuggling via obs-fold Header Conti -
CVE-2026-48932
Node.js 22/24/26 请求失步致头省略
V. Comments for CVE-2026-78605
No comments yet