Skip to content
OpenAdvisories
High WID-SEC-2026-3131 4 CVEs

Elasticsearch: Mehrere Schwachstellen

Published Sep 1, 2026 · Updated Sep 8, 2026 · Revision 2 · de-DE

Vendor: Microsoft Product: Azure Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Elasticsearch ausnutzen, um einen Denial of Service Angriff durchzuführen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen oder vertrauliche Informationen offenzulegen.

Product

Elasticsearch ist eine Open Source, verteilte Echtzeit-Suche und Analyse-Engine.

Vulnerabilities 4

  • High 8.8
    CVE-2026-72649

    Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution

    Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logic to execute with a …

    Elastic Elasticsearch rubygem-elasticsearch Azure Linux
  • Medium 5.9
    CVE-2026-78605

    Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure

    Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33). Under specific proxy deployment configurations, a network attacker could obtain confid…

    Elastic Elasticsearch
  • Medium 5.4
    CVE-2026-78607

    Missing Authorization in Elasticsearch Leading to Information Disclosure

    Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges could cause outbound inference traffic to be directed to a des…

    Elastic Elasticsearch rubygem-elasticsearch Azure Linux
  • Medium 4.9
    CVE-2026-56143

    Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service

    Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a specially crafted request that causes excessive memory consumpti…

    Elastic Elasticsearch rubygem-elasticsearch Azure Linux

Revision history

  1. #2

    Neue Updates aufgenommen

  2. #1

    Initiale Fassung

References