CLEANSTART-2026-BG98783: Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized s...
Security vulnerability affects the sonarqube package. Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/sonarqubeto a version that resolves this vulnerability.Fixed in 26.10.0.133078-r1
Event History
Frequently Asked Questions
Does exploitation require an authenticated or otherwise privileged user?
Yes. The vulnerability is rated PR:L, indicating that an attacker needs low-level privileges before exploitation; it is not described as unauthenticated.
What security impact should responders prioritize?
The primary impact is disclosure of sensitive information, reflected by high confidentiality impact (C:H). Integrity impact is low (I:L), and no availability impact is indicated (A:N).
What kind of deployment activity is relevant to exposure?
The described attack uses a crafted cross-cluster search request and an unauthorized shard identifier. Environments where the affected SonarQube package can issue or process cross-cluster Elasticsearch searches are the relevant exposure scenario.