CVE-2026-102407: Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification
Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data stream to which they were not otherwise authorized, potentially injecting data into it or affecting its ability to be searched normally. This issue does not allow an attacker to read the contents of a data stream they do not otherwise have access to.
Other sources
Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must be authenticated and have sufficient privileges over at least one resource. They can then use the Modify Data Streams API against a data stream for which they would not otherwise be authorized.
What is the practical impact on an affected data stream?
An attacker may be able to inject data into the unauthorized data stream or modify it in a way that affects normal search operation. The issue does not grant the attacker permission to read the contents of that data stream.