AZL-112649: CVE-2026-115298 affecting package rubygem-elasticsearch 8.9.0-1
Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user whose index access is restricted by field-level security can retrieve the value of a constantkeyword field that their role excludes. Some search and query features do not apply the field-level security restriction to this field type.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Authenticated Elasticsearch users whose index permissions use field-level security to exclude constant_keyword fields may be able to retrieve values from those excluded fields.
What access does an attacker need to exploit it?
The attacker must be authenticated and have access to an index where their role is restricted by field-level security. Exploitation relies on search or query features that do not enforce the restriction for constant_keyword fields.
How can I determine whether my deployment is affected?
Review roles that use field-level security to exclude fields on Elasticsearch indices, then identify whether any excluded fields use the constant_keyword type. Those configurations may expose excluded values through affected search or query features.