CVE-2026-78607— Missing Authorization in Elasticsearch Leading to Information Disclosure
Quick assessment
Affected
Elastic Elasticsearch
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
以下是该漏洞描述的中文翻译： Elasticsearch 的自定义推理服务中存在缺失授权（CWE-862）问题，这可能通过权限滥用（CAPEC-122）导致信息泄露。仅持有推理执行权限的用户可以将出站推理流量引导至其自行选择的目标地址，并可能导致由管理员配置的凭据（Credentials）暴露出来。
Possible ATT&CK Techniques 2 AI
T1557 · Adversary-in-the-Middle T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Elastic | Elasticsearch | 8.0.0≤ 8.19.18 |
affected |
9.0.0≤ 9.3.7 |
affected | ||
9.4.0≤ 9.4.3 |
affected | ||
9.5.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-78607
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Missing Authorization in Elasticsearch Leading to Information Disclosure
Source: CVE Program / CVE List V5
Vulnerability Description
Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause administrator-provisioned credentials to be exposed.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Elastic | Elasticsearch | 8.0.0 ~ 8.19.18 | - |
|
II. Public POCs for CVE-2026-78607
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-78607
请登录查看更多情报信息。
Other References for CVE-2026-78607 (1)
Same Patch Batch · Elastic · 2026-09-01 · 20 CVEs total
| CVE-2026-72649 | 8.8 HIGH | Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution |
| CVE-2026-63137 | 8.3 HIGH | Incorrect Authorization in Kibana Leading to Privilege Escalation |
| CVE-2026-78592 | 7.3 HIGH | Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthori |
| CVE-2024-14047 | 7.2 HIGH | Improper Link Resolution Before File Access ('Link Following') in Winlogbeat Leading to Ar |
| CVE-2026-78608 | 6.5 MEDIUM | Missing Authorization in Kibana Leading to Information Disclosure |
| CVE-2026-33465 | 6.5 MEDIUM | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Servic |
| CVE-2026-63138 | 6.5 MEDIUM | Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Infor |
| CVE-2026-72654 | 6.5 MEDIUM | Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure |
| CVE-2026-72628 | 6.5 MEDIUM | Improper Handling of Highly Compressed Data in Kibana Leading to Denial of Service |
| CVE-2026-72652 | 6.5 MEDIUM | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Servic |
| CVE-2026-72644 | 6.5 MEDIUM | Uncaught Exception in Kibana Leading to Denial of Service |
| CVE-2026-72682 | 6.5 MEDIUM | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Servic |
| CVE-2026-78605 | 5.9 MEDIUM | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch L |
| CVE-2026-72641 | 5.4 MEDIUM | Incorrect Authorization in Kibana Leading to Unauthorized Modification of Data |
| CVE-2026-56143 | 4.9 MEDIUM | Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of |
| CVE-2026-72633 | 4.3 MEDIUM | Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitorin |
| CVE-2026-78603 | 4.3 MEDIUM | Missing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Met |
| CVE-2026-78597 | 4.3 MEDIUM | Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation |
| CVE-2026-78606 | 4.2 MEDIUM | Incorrect Authorization in Kibana Leading to Unauthorized Disclosure, Modification, and De |
IV. Related Vulnerabilities
Same product: Elasticsearch
-
CVE-2026-78605
Inconsistent Interpretation of HTTP Requests ('HTTP Request -
CVE-2026-72649
Deserialization of Untrusted Data in Elasticsearch Leading t -
CVE-2026-56143
Allocation of Resources Without Limits or Throttling in Elas -
CVE-2026-72636
Uncontrolled Recursion in Elasticsearch Wildcard Matching Le -
CVE-2026-72642
Use of Out-of-range Pointer Offset in the Elasticsearch Mach
Same vendor: Elastic
-
CVE-2026-63138
Improper Neutralization of Special Elements in Data Query Lo -
CVE-2026-78597
Missing Authorization in Kibana Entity Store Leading to Unau -
CVE-2026-78592
Improper Limitation of a Pathname to a Restricted Directory -
CVE-2026-78606
Incorrect Authorization in Kibana Leading to Unauthorized Di -
CVE-2026-78603
Missing Authorization in Kibana Leading to Unauthorized Disc
Same weakness: CWE-862
-
CVE-2026-78597
Missing Authorization in Kibana Entity Store Leading to Unau -
CVE-2026-78603
Missing Authorization in Kibana Leading to Unauthorized Disc -
CVE-2026-78608
Missing Authorization in Kibana Leading to Information Discl -
CVE-2026-84204
GROWI through 8.0.2 Missing Authorization on apiv3 Attachmen -
CVE-2026-19948
Cozy Blocks <= 2.2.17 - Missing Authorization to Unauthentic
V. Comments for CVE-2026-78607
No comments yet