CVE-2026-103009

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-103009
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103009.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-103009
Downstream
MINI (21)
Published
2026-10-06T19:31:53Z
Modified
2026-10-11T07:05:36Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
Summary
Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure
Details

Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of cross-cluster search requests made through the Remote Cluster Security (RCS) 2.0 model. An authorization check validates a request against one identifying attribute of the target shard, while a separate, independently-supplied identifying attribute in the same request determines which shard is actually accessed. A holder of a cross-cluster API key authorized for one index can craft a request whose two identifying attributes refer to different indices, causing the request to be authorized against an index they can access while actually operating against a different, unauthorized index. This can expose that index's document contents, field mappings, and other metadata, and in limited cases allows modification of retention-lease state on the unauthorized index.

Database specific 
{
    "cna_assigner": "elastic",
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103009.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "8.13.0"
                },
                {
                    "last_affected": "8.19.22"
                },
                {
                    "introduced": "9.0.0"
                },
                {
                    "last_affected": "9.4.7"
                },
                {
                    "introduced": "9.5.0"
                },
                {
                    "last_affected": "9.5.4"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/elastic/elasticsearch

Affected ranges

Type
GIT
Repo
https://github.com/elastic/elasticsearch
Events
Introduced
09df99393193b2c53d92899662a8b8b3c55b45cd
Fixed
6940e499f8a38841809b8e295a20c6421c95d9e4
Introduced
112859b85d50de2a7e63f73c8fc70b99eea24291
Fixed
c042abbb0eaaaa61b49beef21d517468861a4db2
Introduced
8d4246a64bc255212407b1b313fe402391299c88
Fixed
48acba663b09e70b115dd879329141506c377890
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "8.13.0"
        },
        {
            "fixed": "8.19.23"
        },
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.4.8"
        },
        {
            "introduced": "9.5.0"
        },
        {
            "fixed": "9.5.5"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v9.*
v9.5.0
v9.5.1
v9.5.2
v9.5.3
v9.5.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103009.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "274518215284647076646986422064463465829",
            "length": 88
        },
        "id": "CVE-2026-103009-1ec51e31",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4",
        "target": {
            "file": "server/src/main/java/org/elasticsearch/search/SearchService.java",
            "function": "findReaderContext"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "34716596029123053891622503665744975522",
                "136597128455756969875199639982053850246",
                "33114870576535538868732528378817237038",
                "24535752106006161089390341154763835781",
                "32025328027204743683123658321447485435",
                "237294143449399198062954492160161008815",
                "60108391526600641876635922575949266596",
                "221188683218490460210398357043319878397"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-103009-2f0f1493",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4",
        "target": {
            "file": "server/src/test/java/org/elasticsearch/search/SearchServiceSingleNodeTests.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "32219766351204362524735889854234264931",
            "length": 1399
        },
        "id": "CVE-2026-103009-3782cdc9",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4",
        "target": {
            "file": "server/src/main/java/org/elasticsearch/search/SearchService.java",
            "function": "executeQueryPhase"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "235327354171772893933086404919646769443",
            "length": 1292
        },
        "id": "CVE-2026-103009-3ee61f2a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4",
        "target": {
            "file": "server/src/main/java/org/elasticsearch/search/SearchService.java",
            "function": "executeRankFeaturePhase"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "274241121916035881124943068305157393030",
            "length": 1652
        },
        "id": "CVE-2026-103009-6f2d8738",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4",
        "target": {
            "file": "server/src/main/java/org/elasticsearch/search/SearchService.java",
            "function": "executeQueryPhase"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "90954522904478845627767809963626966632",
                "312202333282412865980452074165561988045",
                "201502984854532540743675824692178650491",
                "133021856339520246587832744823698128960",
                "118567998432359533306447586005283286049",
                "321063442713962830327798090638255728923",
                "116674126915488887653231158661015327407",
                "340129969494685833618437681997224425313",
                "135673196400076405753847860598907169645",
                "122311869659862480733078545751265298438",
                "252396072946849092724372221039036583896",
                "135357956602451340512845621008925333259",
                "91393826567900247708322597243985039115",
                "257536988596658647353060035863545299747",
                "635876167132524114432519423301563958",
                "211976191649846492472867523364748761608",
                "301472925400710851361978247629893735954",
                "178249879224873702898662621420154824388",
                "203141962289939396495271583042215390544"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-103009-903e63cd",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/48acba663b09e70b115dd879329141506c377890",
        "target": {
            "file": "server/src/internalClusterTest/java/org/elasticsearch/index/shard/IndexShardIT.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "125383642980696038228423249885037087907",
                "261471238883245253485251707982464042313",
                "51524100471773408154896944447657589948",
                "150723850866291844801996221671924990416",
                "207421814369850706103188983726593940012",
                "166638929813184654751768272241137507630",
                "95835334912135568405368318097647697053",
                "11612101662951389857776078248968042366",
                "207179221818971715728185224961636436712",
                "313874217088966083471250075545492088509",
                "6338586734438517569513032664491806449",
                "272623717981358433156931308570258987872",
                "250519116710560595780417356042205004283",
                "147033079518902172069276829288106239716",
                "232897152212846557099322254530811851848",
                "44965062797649795644289816277533058107",
                "256310236651437823324933622355259162656",
                "69436595654197042399739765684566601412",
                "235333455269776207681922667062920513645",
                "119654270185562309618377567339508536991",
                "104528801602712543598070207070642880404",
                "60728570034104267633092155969410265256",
                "305618196026062664978599614252660928550",
                "251449639069083971095559418835930320627",
                "121666292089624949203915345112863555426",
                "201091802252295406525026940957880463055",
                "295569246277314332311962311211454875241",
                "184403754202836771555674635759170971452",
                "18563896754100733089287727373632305962",
                "159887752230878929646097633553909623864",
                "148503729247859112451805457840207032476",
                "244450234615412336555037175802376151754",
                "181889403959156383495359725209580327736",
                "17089704399309520885335187793594783096",
                "302749772054223353303233085400080146587",
                "85384856571905711248474779555553173266",
                "270211841947528204804027033771640011839",
                "162938967126245291415434870730801502108",
                "170349590110038710594840105573559665545",
                "234755445075301857904488272943416829659",
                "63010649486780191677521355742600849790",
                "324721074450501520324696603013574532318",
                "163849468510296036997020811893318968050",
                "99425507450331617689097946060610002120",
                "138512551789884651998896184195254595579",
                "65925264456461681032564025634813139461",
                "209313892152408238957810889544936258562",
                "225048483034576615624641398918704791145",
                "313588144374663490471362910627622796992",
                "8136684546292520340104302962964267873",
                "40871157852258026916726652046562781890",
                "162820149852636856132339780010618230462",
                "158612464768460328536137711547305583511",
                "33126129005482477766989129895442561321",
                "17493167302562197822319584750814321714",
                "148993112694963710266097750401657888597",
                "233484244068601829730549177364862208163",
                "226123353023713216192924934405342343346",
                "192873641240662247147599811365702116313"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-103009-92955005",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4",
        "target": {
            "file": "server/src/main/java/org/elasticsearch/search/SearchService.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "139800561303427826632305893219156980695",
            "length": 797
        },
        "id": "CVE-2026-103009-9f3d66c3",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/48acba663b09e70b115dd879329141506c377890",
        "target": {
            "file": "server/src/internalClusterTest/java/org/elasticsearch/index/shard/IndexShardIT.java",
            "function": "testNodeWriteLoadsArePresent"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "90954522904478845627767809963626966632",
                "312202333282412865980452074165561988045",
                "201502984854532540743675824692178650491",
                "133021856339520246587832744823698128960",
                "118567998432359533306447586005283286049",
                "321063442713962830327798090638255728923",
                "116674126915488887653231158661015327407",
                "340129969494685833618437681997224425313",
                "135673196400076405753847860598907169645",
                "122311869659862480733078545751265298438",
                "252396072946849092724372221039036583896",
                "135357956602451340512845621008925333259",
                "91393826567900247708322597243985039115",
                "257536988596658647353060035863545299747",
                "635876167132524114432519423301563958",
                "211976191649846492472867523364748761608",
                "301472925400710851361978247629893735954",
                "178249879224873702898662621420154824388",
                "203141962289939396495271583042215390544"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-103009-a1e3c91c",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/c042abbb0eaaaa61b49beef21d517468861a4db2",
        "target": {
            "file": "server/src/internalClusterTest/java/org/elasticsearch/index/shard/IndexShardIT.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "139800561303427826632305893219156980695",
            "length": 797
        },
        "id": "CVE-2026-103009-a4a25bad",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/c042abbb0eaaaa61b49beef21d517468861a4db2",
        "target": {
            "file": "server/src/internalClusterTest/java/org/elasticsearch/index/shard/IndexShardIT.java",
            "function": "testNodeWriteLoadsArePresent"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "86672828041889460988485494404978863879",
            "length": 1547
        },
        "id": "CVE-2026-103009-aa500e53",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4",
        "target": {
            "file": "server/src/main/java/org/elasticsearch/search/SearchService.java",
            "function": "executeFetchPhase"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "250013348203320901709327575092186631989",
                "136736397440448403411052668355334902910",
                "32079631131251667747258365325591770630",
                "279338845067386713446719130847193884756",
                "62569786264280762641421666368736817258",
                "285783017263267208960745337074099265923",
                "200351550324051570850358398506880628018",
                "67430965804828112084137267484606316507",
                "4197170716383299639952075926883047836",
                "45557402670247067755892574231513103835",
                "293861044391672734879588009163626417005",
                "192185246724442387903294071867609776005",
                "20339230060257156808559960575204347382",
                "129937661334763822309905753508217697407",
                "320834131378315414869823519671573111780",
                "237590822914800589904946117160349354191",
                "28411078344575547472561388731524586345",
                "284626241710301775182826724147561956414",
                "279120247205670146858886130607970997824",
                "47517463461575784382003141253476483887",
                "288671565162871039380462974768299334301",
                "96242774579101872059738612669764242573",
                "186455008403005080913340749458793035246",
                "333602489265304513498139927960045489303"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-103009-aae647a1",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4",
        "target": {
            "file": "server/src/internalClusterTest/java/org/elasticsearch/action/search/PointInTimeIT.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "175610603023598627067230817325853111696",
            "length": 501
        },
        "id": "CVE-2026-103009-e56db8ce",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4",
        "target": {
            "file": "server/src/main/java/org/elasticsearch/search/SearchService.java",
            "function": "findReaderContext"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "313574142537140578542602811868543830438",
            "length": 889
        },
        "id": "CVE-2026-103009-e66282a2",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4",
        "target": {
            "file": "server/src/main/java/org/elasticsearch/search/SearchService.java",
            "function": "createOrGetReaderContext"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "110548918634932471290745783473457952077",
            "length": 1433
        },
        "id": "CVE-2026-103009-e72e7bac",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4",
        "target": {
            "file": "server/src/main/java/org/elasticsearch/search/SearchService.java",
            "function": "executeFetchPhase"
        }
    }
]
vanir_signatures_modified 
"2026-10-11T07:05:36Z"