org.elasticsearch.plugin:x-pack-esql (>=9.4.0, <=9.4.2), org.elasticsearch.plugin:x-pack-esql-compute (>=9.4.0, <=9.4.2) +4 more potentially affected by CVE-2026-56148 via org.elasticsearch:elasticsearch (>=9.4.0, <=9.4.2)

org.elasticsearch:elasticsearch MAVEN version =9.4.0, =9.4.0, =9.4.0, =9.4.0, =9.4.0, =9.4.0, =9.4.2 - pl.allegro.tech.elasticsearch.plugin:elasticsearch-analysis-morfologik 9.4.2 Source cves: CVE-2026-56148 Source advisory: SNYK:JAVA-ORGELASTICSEARCH-17821211...

org.elasticsearch.plugin:x-pack-esql (>=9.4.0, <=9.4.2), org.elasticsearch.plugin:x-pack-esql-compute (>=9.4.0, <=9.4.2) +4 more potentially affected by CVE-2026-56149 via org.elasticsearch:elasticsearch (>=9.4.0, <=9.4.2)

org.elasticsearch:elasticsearch MAVEN version =9.4.0, =9.4.0, =9.4.0, =9.4.0, =9.4.0, =9.4.0, =9.4.2 - pl.allegro.tech.elasticsearch.plugin:elasticsearch-analysis-morfologik 9.4.2 Source cves: CVE-2026-56149 Source advisory: MEND:CVE-2026-56149...

esql-injection-poc

ES|QL Source-Index Injection — Remote Exploitation PoC Targ...