Elasticsearch CVE-2026-102409

Exploitation requires valid Elasticsearch authentication at a low privilege level (PR:L) - the attacker must be able to submit authenticated requests to the cluster, so clusters with enforced authentication limit this to insiders, compromised credentials, or over-permissive accounts. Given AV:N/AC:L/UI:N, no user interaction, no special non-default configuration, and no local access are needed beyond that authenticated network reach. Impact is strictly availability: a successful request triggers uncontrolled recursion and excessive memory allocation that terminates the node; it does not expose or modify data. The primary limiting factor is the authentication requirement - anonymous or unauthenticated attackers cannot reach this via the described path.

This is a moderate, availability-only risk rather than a top-tier emergency. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is internally consistent with the description: network-reachable, low attack complexity, requires low-privilege authentication, no user interaction, unchanged scope, and impact limited purely to availability (C:N/I:N/A:H). The 6.5 base score is driven entirely by the ability to crash an Elasticsearch node (denial of service) with no confidentiality or integrity consequence. No EPSS score, CISA KEV listing, or public POC was provided in the input, so exploitation pressure signals are absent - there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is bounded by the PR:L requirement: an attacker must already possess valid (even if low-privileged) Elasticsearch credentials, which limits exposure to insiders, compromised service accounts, or clusters with weak/over-permissive authentication. The main uncertainty is that no quantitative exploitation probability (EPSS) is available to gauge likelihood, and the single vendor reference (ESA-2026-190) is a discuss.elastic.co advisory rather than a parsed NVD record, so affected-version details should be confirmed directly against the Elastic advisory.

An attacker holding low-privilege but valid Elasticsearch credentials (e.g., a compromised application service account) sends a specially crafted request that triggers uncontrolled recursion and excessive memory allocation, exhausting resources and terminating the targeted node. Repeating this against cluster nodes causes a denial of service that can degrade or take down the search/logging backend. No public exploit code was identified at time of analysis, and low attack complexity means a working exploit would be straightforward once the triggering request is known.