CVE-2026-78607: Missing Authorization in Elasticsearch Leading to Information Disclosure
Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause administrator-provisioned credentials to be exposed.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already have inference execution privileges in Elasticsearch. The issue does not describe exploitation by an unauthenticated user.
What is the practical impact of exploitation?
A user with inference execution privileges may direct outbound inference traffic to a destination they choose. This could expose credentials provisioned by an administrator and disclose information.
What configurations are exposed?
The affected functionality is the Elasticsearch custom inference service. The provided information does not state whether this service is enabled or configured by default.
How can I assess whether my deployment is at risk?
Review whether the custom inference service is in use and identify users or roles granted inference execution privileges. Deployments where such users can invoke administrator-configured inference integrations are the relevant exposure scenario.