CVE-2026-103007

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-103007

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103007.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-103007

Downstream

MINI (20)

Published

2026-10-06T19:31:50Z

Modified

2026-10-11T07:05:37Z

Severity

7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Incorrect Authorization in Elasticsearch Leading to Privilege Escalation

Details

Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator delegate limited role-management capability to another user, scoped to specific indices. The authorization check that enforces this scoping does not correctly account for a role-definition setting that can expand the matched index set. A user holding this delegated privilege with a broadly-scoped index pattern can exploit this inconsistency by updating their own assigned role to gain access to indices that should remain restricted, including internal security data. This can enable further escalation up to full administrative control of the cluster.

Database specific

{
    "cna_assigner": "elastic",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103007.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "8.16.0"
                },
                {
                    "last_affected": "8.19.21"
                },
                {
                    "introduced": "9.0.0"
                },
                {
                    "last_affected": "9.4.6"
                },
                {
                    "introduced": "9.5.0"
                },
                {
                    "last_affected": "9.5.3"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/elastic/elasticsearch

Affected ranges

Type

GIT

Repo

https://github.com/elastic/elasticsearch

Events

Introduced

12ff76a92922609df4aba61a368e7adf65589749

Fixed

3b2a41103de35e0af4064d647974032fcc1bcde9

Introduced

112859b85d50de2a7e63f73c8fc70b99eea24291

Fixed

9093bd876e86f531329aad3704ec9ab607c909c8

Introduced

8d4246a64bc255212407b1b313fe402391299c88

Fixed

9170df19cae1adb107b7b489b4d82dec66d7a337

Database specific

Show details

{
    "cpe": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "8.16.0"
        },
        {
            "fixed": "8.19.22"
        },
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.4.7"
        },
        {
            "introduced": "9.5.0"
        },
        {
            "fixed": "9.5.4"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v9.*

v9.5.0

v9.5.1

v9.5.2

v9.5.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103007.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "189585172861838996260594045432913974809",
                "175617604165790565707814263107919501563",
                "130477306067630685023998084591392665861",
                "36999073119133500855825947731211620899",
                "35496704402531110263444495126452294887",
                "193629641451614468896077035891730603339",
                "93256201030827239812611339693619290343"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-103007-3ec8fc58",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/9170df19cae1adb107b7b489b4d82dec66d7a337",
        "target": {
            "file": "modules/reindex/src/test/java/org/elasticsearch/reindex/ReindexIdTests.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "196795326833912774001160856107963653990",
                "38118015694161648612726926093733984960",
                "244889608847896122430447055695918303345",
                "257344421705922307385881243254891741182",
                "137363185453583447603574814007296199056",
                "293305666452695760163829550541004355849",
                "197353426610396809599568304775146892166",
                "144755885865340705515879378218993276926",
                "53917711841626796700495571597708014933",
                "167396584241779245902981123042493582178"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-103007-8a40a35f",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/3b2a41103de35e0af4064d647974032fcc1bcde9",
        "target": {
            "file": "x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authc/RoleMappingMetadataTests.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "310522140138316022518419935707739395028",
                "220506359429938391470231622354596337924",
                "219515872514158714194530369631554513551",
                "72875614186927229648598956343240896653",
                "24931804176326139699093856965312916942",
                "278658042864375250898856391712600044029",
                "292645850425456433315693329416219707811",
                "19099310233446518390734610261039242273"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-103007-a012b938",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/3b2a41103de35e0af4064d647974032fcc1bcde9",
        "target": {
            "file": "x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/RoleMappingMetadata.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "53903834108608215261043438896920248088",
            "length": 713
        },
        "id": "CVE-2026-103007-bb6f1b53",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/9170df19cae1adb107b7b489b4d82dec66d7a337",
        "target": {
            "file": "modules/reindex/src/test/java/org/elasticsearch/reindex/ReindexIdTests.java",
            "function": "testConversionErrorContainsDocId"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "330719214728980570805379930566702990837",
            "length": 44
        },
        "id": "CVE-2026-103007-bde9c9dd",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/3b2a41103de35e0af4064d647974032fcc1bcde9",
        "target": {
            "file": "x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/RoleMappingMetadata.java",
            "function": "context"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "28436815834783085882518553060634476245",
                "207026095812260449332587403736322408156",
                "248326001396843754678852152164781995025",
                "190848085151408171053126995181094503785"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-103007-c3a7e10e",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/9170df19cae1adb107b7b489b4d82dec66d7a337",
        "target": {
            "file": "server/src/test/java/org/elasticsearch/action/search/MultiSearchRequestTests.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "330198251486159926172026056579191739971",
            "length": 1155
        },
        "id": "CVE-2026-103007-cecd2635",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/9170df19cae1adb107b7b489b4d82dec66d7a337",
        "target": {
            "file": "server/src/test/java/org/elasticsearch/action/search/MultiSearchRequestTests.java",
            "function": "testFailOnExtraCharacters"
        }
    }
]

vanir_signatures_modified

"2026-10-11T07:05:37Z"