CVE-2026-56144: Incorrect Authorization in Elasticsearch Leading to Information Disclosure
Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature. By targeting indices they are not authorized to access directly, the user can cause those indices' configured ingest pipelines to execute and return their output, potentially disclosing data processed or enriched by those pipelines. Additionally, the same feature can be used to retrieve index mapping metadata for indices the user are not authorized to access directly.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56144?
The severity of CVE-2026-56144 is medium with a score of 5.3.
How do I fix CVE-2026-56144?
To fix CVE-2026-56144, ensure that proper authorization controls are enforced for the ingest simulation feature in Elasticsearch.
What does CVE-2026-56144 affect?
CVE-2026-56144 affects Elasticsearch and specifically the ingest simulation feature.
What type of vulnerability is CVE-2026-56144?
CVE-2026-56144 is categorized as an Incorrect Authorization vulnerability, leading to potential information disclosure.
Who is affected by CVE-2026-56144?
Authenticated users with limited index privileges in Elasticsearch may be affected by CVE-2026-56144.