---
id: "CVE-2026-115290"
kind: "vulnerability"
aliases: ["CVE-2026-115290"]
title: "Elasticsearch: unauthenticated crafted request to the remote cluster server interface crashes the node"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "elasticsearch", "fixed": ["8.19.24", "9.4.9", "9.5.6"], "affected": ">= 8.10.0, <= 8.19.23; >= 9.0.0, <= 9.4.8; >= 9.5.0, <= 9.5.5", "ecosystem": "vendor"}]
ecosystems: []
tags: ["denial-of-service", "elasticsearch", "kubernetes", "runtime", "self-hosted", "unauthenticated"]
not_affected_if: ["default-config", "managed-hosting", "remote-cluster-server-disabled", "unknown"]
published_at: "2026-11-03T17:17:54+00:00"
first_seen_at: "2026-11-03T17:21:54+00:00"
updated_at: "2026-11-03T17:28:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115290", "first_seen_at": "2026-11-03T17:21:54+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T17:28:19+00:00"}]
---

# Elasticsearch: unauthenticated crafted request to the remote cluster server interface crashes the node

Uncontrolled recursion (CWE-674) when Elasticsearch handles serialized data with nested payloads. Per Elastic (ESA-2026-201), an unauthenticated attacker with network access to a node's remote cluster server interface can send a crafted request that terminates the node, and can repeat it against each reachable node. CVSS 7.5. Elastic does not report exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:elasticsearch affected >= 8.10.0, <= 8.19.23; >= 9.0.0, <= 9.4.8; >= 9.5.0, <= 9.5.5 fixed 8.19.24, 9.4.9, 9.5.6

## How to check

1) Version: run curl -s localhost:9200 (add credentials if required) on each node; affected are 8.10.0-8.19.23, 9.0.0-9.4.8 and 9.5.0-9.5.5. 2) Exposure: only nodes with the remote cluster server interface enabled are affected (disabled by default). Look for remote_cluster_server.enabled: true in elasticsearch.yml and check which networks can reach that interface. 3) IOC per Elastic: unexpected node termination with a fatal stack overflow or out-of-memory error logged while handling a connection on the remote cluster server interface.

## Fix

Upgrade to Elasticsearch 8.19.24, 9.4.9 or 9.5.6 (or later). If you cannot upgrade: set remote_cluster_server.enabled to false in elasticsearch.yml on each node and restart (only if you do not use API-key based remote cluster connections), or IP-filter the remote cluster interface to your trusted remote clusters' addresses.

## Timeline

- 2026-11-03T17:21:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115290
- 2026-11-03T17:28:19+00:00 analyst — Elastic ESA-2026-201 read directly: versions, fix, config condition (remote_cluster_server enabled, off by default), workarounds (disable or IP-filter). Not exploited per source; NVD page returned empty. Mitigations not verified: none were vendor WAF type.

## Documents

- [advisory] Elasticsearch 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-201) https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-201/391356

## From the sources

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate. No credentials are required. The attacker can repeat the request against each reachable node.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_