AZL-112652: CVE-2026-115710 affecting package rubygem-elasticsearch 8.9.0-1
Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and incorrect search results via specially crafted search requests. For some query types, Elasticsearch can share cached query results between users who have field-level security restrictions and users who do not. A user restricted by field-level security can learn which documents match a value in a field that they cannot read. A restricted user can also cause users with full access to receive incomplete search results. Disclosure is only possible when a user with full access ran the same query on the same shard recently.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Elasticsearch deployments where some users have field-level security restrictions while other users have unrestricted access are exposed. The issue depends on both types of users querying the same shard.
What must happen for information disclosure to occur?
A user with full access must have recently run the same query on the same shard. A restricted user can then use a specially crafted search request to infer which documents match a value in a field they are not permitted to read.
Can the issue affect search-result integrity as well as confidentiality?
Yes. A user subject to field-level security restrictions can cause users with full access to receive incomplete search results.