CVE-2026-103007: Incorrect Authorization in Elasticsearch Leading to Privilege Escalation
Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator delegate limited role-management capability to another user, scoped to specific indices. The authorization check that enforces this scoping does not correctly account for a role-definition setting that can expand the matched index set. A user holding this delegated privilege with a broadly-scoped index pattern can exploit this inconsistency by updating their own assigned role to gain access to indices that should remain restricted, including internal security data. This can enable further escalation up to full administrative control of the cluster.
Affected Software
Event History
Frequently Asked Questions
Is a default Elasticsearch deployment affected?
The affected capability is configurable and non-default. Exposure requires an administrator to have delegated limited role-management privileges to a user, with that delegation scoped to specific indices.
What does an attacker need to exploit this issue?
The attacker must already hold the delegated administrative privilege and have a broadly scoped index pattern. They can then update their own assigned role to access indices outside the intended restriction, potentially including internal security data.
How severe can the impact become after exploitation?
A successful attacker can gain access to restricted indices and internal security data. The issue can support further privilege escalation up to full administrative control of the cluster.