{"id":"CVE-2026-115290","kind":"vulnerability","aliases":["CVE-2026-115290"],"related":[],"title":"Elasticsearch: unauthenticated crafted request to the remote cluster server interface crashes the node","description":"Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate. No credentials are required. The attacker can repeat the request against each reachable node.","summary":"Uncontrolled recursion (CWE-674) when Elasticsearch handles serialized data with nested payloads. Per Elastic (ESA-2026-201), an unauthenticated attacker with network access to a node's remote cluster server interface can send a crafted request that terminates the node, and can repeat it against each reachable node. CVSS 7.5. Elastic does not report exploitation.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"elasticsearch","fixed":["8.19.24","9.4.9","9.5.6"],"affected":">= 8.10.0, <= 8.19.23; >= 9.0.0, <= 9.4.8; >= 9.5.0, <= 9.5.5","ecosystem":"vendor"}],"ecosystems":[],"tags":["denial-of-service","elasticsearch","kubernetes","runtime","self-hosted","unauthenticated"],"not_affected_if":["default-config","managed-hosting","remote-cluster-server-disabled","unknown"],"how_to_check":"1) Version: run curl -s localhost:9200 (add credentials if required) on each node; affected are 8.10.0-8.19.23, 9.0.0-9.4.8 and 9.5.0-9.5.5. 2) Exposure: only nodes with the remote cluster server interface enabled are affected (disabled by default). Look for remote_cluster_server.enabled: true in elasticsearch.yml and check which networks can reach that interface. 3) IOC per Elastic: unexpected node termination with a fatal stack overflow or out-of-memory error logged while handling a connection on the remote cluster server interface.","fix":"Upgrade to Elasticsearch 8.19.24, 9.4.9 or 9.5.6 (or later). If you cannot upgrade: set remote_cluster_server.enabled to false in elasticsearch.yml on each node and restart (only if you do not use API-key based remote cluster connections), or IP-filter the remote cluster interface to your trusted remote clusters' addresses.","status":"open","published_at":"2026-11-03T17:17:54+00:00","first_seen_at":"2026-11-03T17:21:54+00:00","triaged_at":"2026-11-03T17:24:03+00:00","updated_at":"2026-11-03T17:28:19+00:00","category":"runtime","confidence":0.9,"triage":{"at":"2026-11-03T17:24:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Elasticsearch: crafted nested request crashes nodes, causing denial of service","impact":"low","summary":"Elasticsearch has uncontrolled recursion when parsing serialized data with nested payloads. An unauthenticated attacker with network access to a node's remote cluster interface can send a crafted request that terminates the node.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["elasticsearch","self-hosted","kubernetes"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker repeatedly crashes each reachable Elasticsearch node, causing denial of service","analyst_note":"Find the affected and fixed Elasticsearch versions and whether remote cluster server must be enabled; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-115290 and the Elastic advisory.","how_to_check":"- Check the Elasticsearch version on each node with `curl -s localhost:9200` and compare it to the affected ranges, which the sources do not list: unknown\n- Check whether the remote cluster server interface (transport port) is reachable from untrusted networks: unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Clusters whose remote cluster server interface is reachable from networks an attacker can use. The sources do not state which versions are affected or whether remote cluster server must be enabled, so the exact exposure is unknown. Teams that keep the transport interface on a private network are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000712,"input_tokens":4160,"output_tokens":591,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed Elasticsearch versions and whether remote cluster server must be enabled; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-115290 and the Elastic advisory.","search":"'-115290':16A,19A '-201':48B '-2026':15A,18A,47B '-230':106C '-674':35B,90C '7.5':81B 'access':54B,112C 'attack':51B,109C,139C 'capec':105C 'caus':129C 'cluster':8A,60B,116C 'craft':3A,66B,126C 'crash':11A 'credenti':135C 'cve':14A,17A 'cvss':80B 'cwe':34B,89C 'data':40B,101C 'denial':22B,96C 'denial-of-servic':21B 'elast':45B,82B 'elasticsearch':1A,20A,25B,37B,92C 'esa':46B 'exploit':86B 'handl':38B 'host':30B 'interfac':10A,62B,118C 'kubernet':26B 'lead':94C 'nest':42B,103C 'network':53B,111C 'node':13A,57B,71B,79B,121C,131C,147C 'payload':43B,104C 'per':44B 'reachabl':78B,146C 'recurs':33B,88C 'remot':7A,59B,115C 'repeat':74B,141C 'report':85B 'request':4A,67B,127C,143C 'requir':137C 'runtim':27B 'self':29B 'self-host':28B 'send':64B,123C 'serial':39B,100C 'server':9A,61B,117C 'servic':24B,98C 'special':125C 'termin':69B,133C 'unauthent':2A,31B,50B,108C 'uncontrol':32B,87C 'via':99C","nicknames":[],"mitigations":[],"who_affected":"Self-managed Elasticsearch nodes (8.10.0 to 8.19.23, 9.0.0 to 9.4.8, 9.5.0 to 9.5.5) that have the remote cluster server interface enabled, which is used for API-key based cross-cluster search and replication, are exposed to anyone who can reach that interface; no credentials are needed. It is disabled by default, so clusters not using it can skip this. Elastic says Elastic Cloud Serverless was fixed before disclosure.","tier":"B","verified":{"fix":{"at":"2026-11-03T17:28:19Z","by":"analyst","doc":"https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-201/391356","run_id":1517},"products":{"at":"2026-11-03T17:28:19Z","by":"analyst","doc":"https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-201/391356","run_id":1517},"how_to_check":{"at":"2026-11-03T17:28:19Z","by":"analyst","doc":"https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-201/391356","run_id":1517},"who_affected":{"at":"2026-11-03T17:28:19Z","by":"analyst","doc":"https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-201/391356","run_id":1517}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["elasticsearch"],"ptokens":["elasticsearch"],"labels":["denialofservice","elasticsearch","high","kubernetes","runtime","selfhosted","unauthenticated"],"campaign_type":null,"first_public_at":"2026-11-03T17:17:54+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security@elastic.co","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115290","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115290","severity":null,"published_at":"2026-11-03T17:17:54+00:00","modified_at":"2026-11-03T17:17:54+00:00","first_seen_at":"2026-11-03T17:21:54+00:00","fetched_at":"2026-11-03T17:21:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115290:1517","url":null,"severity":null,"published_at":"2026-11-03T17:28:19+00:00","modified_at":"2026-11-03T17:28:19+00:00","first_seen_at":"2026-11-03T17:28:19+00:00","fetched_at":"2026-11-03T17:28:19+00:00","note":"Elastic ESA-2026-201 read directly: versions, fix, config condition (remote_cluster_server enabled, off by default), workarounds (disable or IP-filter). Not exploited per source; NVD page returned empty. Mitigations not verified: none were vendor WAF type."}],"documents":[{"id":59290,"url":"https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-201/391356","title":"Elasticsearch 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-201)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}