CVE-2026-115710: Use of Cache Containing Sensitive Information in Elasticsearch Leading to Information Disclosure
Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and incorrect search results via specially crafted search requests. For some query types, Elasticsearch can share cached query results between users who have field-level security restrictions and users who do not. A user restricted by field-level security can learn which documents match a value in a field that they cannot read. A restricted user can also cause users with full access to receive incomplete search results. Disclosure is only possible when a user with full access ran the same query on the same shard recently.
Event History
Frequently Asked Questions
Which environments are exposed to this issue?
Exposure requires both users subject to field-level security restrictions and users with full access. The affected query must be run against the same shard, and cached results must be shared between those users.
What must occur for information disclosure to be possible?
A user with full access must have run the same query on the same shard recently. A field-level-restricted user can then use specially crafted search requests to learn which documents match a value in a field they cannot read.
Is the impact limited to disclosure?
No. A restricted user can also cause users with full access to receive incomplete search results, resulting in incorrect search output.