CVE-2026-103009: Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure
Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of cross-cluster search requests made through the Remote Cluster Security (RCS) 2.0 model. An authorization check validates a request against one identifying attribute of the target shard, while a separate, independently-supplied identifying attribute in the same request determines which shard is actually accessed. A holder of a cross-cluster API key authorized for one index can craft a request whose two identifying attributes refer to different indices, causing the request to be authorized against an index they can access while actually operating against a different, unauthorized index. This can expose that index's document contents, field mappings, and other metadata, and in limited cases allows modification of retention-lease state on the unauthorized index.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs a cross-cluster API key authorized for at least one index and must be able to submit a specially crafted cross-cluster search request under the Remote Cluster Security 2.0 model. The issue is not described as exploitable without credentials.
What data or actions can be exposed on an unauthorized index?
An attacker may expose document contents, field mappings, and other metadata from an index that their API key is not authorized to access. In limited cases, they may also modify retention-lease state on that unauthorized index.
Which deployments are relevant to triage?
Deployments using cross-cluster search with the Remote Cluster Security 2.0 model are relevant, particularly where cross-cluster API keys are scoped to specific indices. The provided information does not identify affected versions or state whether this configuration is enabled by default.