Live › vulnerability › CVE-2026-115298
Elasticsearch search and query features skip field-level security for constant_keyword fields. An authenticated user whose role excludes such a field can still read its value.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
Only deployments that use field-level security to hide a constant_keyword field from some users are exposed, and the user needs a valid account. Clusters without field-level security restrictions on such fields are not affected by this flaw. The sources do not list the affected version ranges.
No product ranges from the sources yet.
GET / and compare it against the fixed versions in the product ranges (unknown in the sources).constant_keyword fields together with field-level security roles.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user whose index access is restricted by field-level security can retrieve the value of a constant_keyword field that their role excludes. Some search and query features do not apply the field-level security restriction to this field type.
This page as .md · .json · in your agent: get_signal("CVE-2026-115298")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.