Elasticsearch Ingest Simulation Auth Bypass (CWE-863)
CVE-2026-56144 Published on July 21, 2026
Incorrect Authorization in Elasticsearch Leading to Information Disclosure
Incorrect Authorization (CWE-863) in Elasticsearch can allow an authenticated user with limited index privileges to exploit insufficient authorization controls in the ingest simulation feature. By targeting indices they are not authorized to access directly, the user can cause those indices' configured ingest pipelines to execute and return their output, potentially disclosing data processed or enriched by those pipelines. Additionally, the same feature can be used to retrieve index mapping metadata for indices the user are not authorized to access directly.
Vulnerability Analysis
CVE-2026-56144 is exploitable with network access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-56144 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-56144
Want to know whenever a new CVE is published for Elasticsearch? stack.watch will email you.
Affected Versions
Elasticsearch:- Version 9.4.0, <= 9.4.3 is affected.
- Version 9.0.0, <= 9.3.6 is affected.
- Version 8.12.0, <= 8.19.17 is affected.