8 matches found
Missing Authorization
Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Missing Authorization via the custom inference service. An attacker can access sensitive information and redirect outbound inferen...
AZL-98445 CVE-2026-78607 affecting package rubygem-elasticsearch 8.9.0-1
Missing Authorization CWE-862 in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse CAPEC-122. A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause...
CVE-2026-78607
Missing Authorization CWE-862 in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse CAPEC-122. A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause...
CVE-2026-78607 Missing Authorization in Elasticsearch Leading to Information Disclosure
Missing Authorization CWE-862 in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse CAPEC-122. A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause...
CVE-2026-78607 Missing Authorization in Elasticsearch Leading to Information Disclosure
Missing Authorization CWE-862 in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse CAPEC-122. A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause...
Elasticsearch 8.19.19, 9.3.8, 9.4.4, 9.5.1 Security Update (ESA-2026-143)
Missing Authorization in Elasticsearch Leading to Information Disclosure Missing Authorization CWE-862 in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse CAPEC-122. A user holding only inference execution privileges could cause outbound inference...
CVE-2026-78607: Missing Authorization
Missing Authorization CWE-862 in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse CAPEC-122. A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause...
PT-2026-84397
Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description Missing authorization in the custom inference service allows a user with only inference execution privileges to redirect outbound inference traffic to an arbitrary destination. This...