BIT-ELASTICSEARCH-2026-103009 Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure

Authorization Bypass Through User-Controlled Key CWE-639 in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of...

PT-2026-111340

Authorization Bypass Through User-Controlled Key CWE-639 in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of...

CVE-2026-103009

A flaw was found in Elasticsearch. When processing cross-cluster search requests under the Remote Cluster Security RCS model, the service validates permissions using one target identifier while retrieving data using a separate identifier. An authenticated attacker possessing a valid cross-cluster...

CVE-2026-103009

Authorization Bypass Through User-Controlled Key CWE-639 in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of...

CVE-2026-103009 Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure

Authorization Bypass Through User-Controlled Key CWE-639 in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of...

CVE-2026-103009 Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure

Authorization Bypass Through User-Controlled Key CWE-639 in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of...

CVE-2026-103009 Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure

Authorization Bypass Through User-Controlled Key CWE-639 in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of...

CVE-2026-103009

Authorization Bypass Through User-Controlled Key CWE-639 in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of...

EUVD-2026-93939

Authorization Bypass Through User-Controlled Key CWE-639 in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of...

CVE-2026-103009

Elasticsearch contains an authorization bypass weakness (CWE-639) within the Remote Cluster Security (RCS) 2.0 model during cross-cluster search requests. The flaw exists because the system validates a request against one identifying attribute while using a separate, independently-supplied attrib...

Authorization Bypass Through User-Controlled Key

Overview org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the handling of cross-cluster search requests under the Remote Cluster Security RCS 2.0 model. An attacker can...

Elasticsearch 8.19.23, 9.4.8, 9.5.5 Security Update (ESA-2026-199)

Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure Authorization Bypass Through User-Controlled Key CWE-639 in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized sha...

PT-2026-107168

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description An authorization bypass exists in the handling of cross-cluster search requests using the Remote Cluster Security RCS 2.0 model. The issue occurs because the system validates a request...

CVE-2026-103009: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key CWE-639 in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of...

Elasticsearch 9.0.x < 9.4.8 / 9.5.x < 9.5.5 Incorrect Authorization (ESA-2026-199)

The version of Elasticsearch installed on the remote host is 9.0.x prior to 9.4.8, or 9.5.x prior to 9.5.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-199 advisory. - Authorization Bypass Through User-Controlled Key CWE-639 in Elasticsearch can lead to Information...

SUSE CVE-2026-7184

Mattermost versions 11.6.x = 11.6.1, 11.5.x = 11.5.4, 10.11.x = 10.11.15 fail to sanitize the Remote Cluster API response on PATCH operations, which allows authenticated users with the managesecureconnections permission to obtain remote cluster authentication tokens via a PATCH request to the...

GO-2026-6282 Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations in github.com/mattermost/mattermost-server

Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations in github.com/mattermost/mattermost-server...

PT-2026-82031

Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations in github.com/mattermost/mattermost-server...

CVE-2026-66788 Lighthouse: lighthouse: arbitrary namespace injection via attacker-controlled broker label

A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows the attacker to inject unauthorized...

SUSE CVE-2026-4273

Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13 fail to validate that the RefreshedToken differs from the original invite token during remote cluster invite confirmation which allows an authenticated attacker to bypass token rotation and reuse the original invite token via sending a craft...