CVE-2026-89261: MoguBlog through 6.2 Missing Authentication for Elasticsearch Index Management Endpoints
MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogusearch service without authentication, allowing remote attackers to delete, recreate, or alter the blog search index. Attackers can invoke POST endpoints to wipe the entire search index, delete specific documents, or inject malicious index entries, causing search functionality to return incorrect or no results.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
MoguBlog installations through version 6.2 are exposed if the mogu_search service and its Elasticsearch index management endpoints are reachable by a remote attacker. Exploitation does not require authentication or user interaction.
What can an unauthenticated attacker do through the affected endpoints?
An attacker can send POST requests to delete the entire search index, delete individual documents, recreate or alter the index, and inject malicious index entries. The resulting impact is limited to search integrity and availability: searches may return incorrect results or no results.
Is there a workaround if patching cannot be performed immediately?
Restrict network access to the mogu_search service and its index management endpoints so untrusted remote users cannot reach them. The provided information does not identify a configuration-based authentication fix.