Live › vulnerability › CVE-2026-115710
Elasticsearch can share cached query results between users with field-level security and users without it, for some query types. A restricted user can learn which documents match a value in a field they cannot read, and can cause full-access users to receive incomplete search results.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
Affects Elasticsearch clusters that use field-level security for some users while other users run the same queries on the same shard. Disclosure requires a full-access user to have run the same query on that shard recently. Clusters without field-level security restrictions are not described as exposed.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and incorrect search results via specially crafted search requests. For some query types, Elasticsearch can share cached query results between users who have field-level security restrictions and users who do not. A user restricted by field-level security can learn which documents match a value in a field that they cannot read. A restricted user can also cause users with full access to receive incomplete search results. Disclosure is only possible when a user with full access ran the same query on the same shard recently.
This page as .md · .json · in your agent: get_signal("CVE-2026-115710")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.