CLEANSTART-2026-PK48426: flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input
Published Nov 7, 2026
·Updated
Security vulnerability affects the sonarqube package. A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input.
Affected Software
1 affected componentFixes available
cleanstart/sonarqube<26.8.0.126808-r5
26.8.0.126808-r5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/sonarqubeto a version that resolves this vulnerability.Fixed in 26.8.0.126808-r5
Event History
Nov 7, 2026
Advisory Published
via OSV·12:37 AM
Data Sourced
via OSV·12:37 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What access must an attacker have before attempting exploitation?
The attacker must be authenticated with a low-privileged user account. The available information does not indicate that unauthenticated access is sufficient.
2
Does exploitation require multiple requests or extended interaction?
The issue can be triggered through a single request containing crafted user-supplied input.