Live › vulnerability › CVE-2026-115290
Uncontrolled recursion (CWE-674) when Elasticsearch handles serialized data with nested payloads. Per Elastic (ESA-2026-201), an unauthenticated attacker with network access to a node's remote cluster server interface can send a crafted request that terminates the node, and can repeat it against each reachable node. CVSS 7.5. Elastic does not report exploitation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
Self-managed Elasticsearch nodes (8.10.0 to 8.19.23, 9.0.0 to 9.4.8, 9.5.0 to 9.5.5) that have the remote cluster server interface enabled, which is used for API-key based cross-cluster search and replication, are exposed to anyone who can reach that interface; no credentials are needed. It is disabled by default, so clusters not using it can skip this. Elastic says Elastic Cloud Serverless was fixed before disclosure.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| elasticsearch | vendor | >= 8.10.0, <= 8.19.23; >= 9.0.0, <= 9.4.8; >= 9.5.0, <= 9.5.5 | 8.19.24, 9.4.9, 9.5.6 |
curl -s localhost:9200 (add credentials if required) on each node; affected are 8.10.0-8.19.23, 9.0.0-9.4.8 and 9.5.0-9.5.5. 2) Exposure: only nodes with the remote cluster server interface enabled are affected (disabled by default)8.19.24, 9.4.9 or 9.5.6 (or later)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate. No credentials are required. The attacker can repeat the request against each reachable node.
This page as .md · .json · in your agent: get_signal("CVE-2026-115290")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.