Elasticsearch CVE-2026-102411

Exploitation requires an authenticated Elasticsearch user holding the manage_index_templates cluster privilege; without that privilege the attack cannot be performed. The attacker must register multiple index-template resources, each populated with a metadata field sized near the enforced per-resource limit, and then trigger a combined retrieval that materializes all metadata values in heap simultaneously. The flaw exists in default behavior for anyone with that privilege (no special non-default configuration is needed), but the privilege requirement itself is the primary limiting factor, restricting the attack to trusted operators, service accounts, or compromised privileged credentials rather than anonymous remote attackers; impact is limited to availability (node OOM) with no confidentiality or integrity effect.

This is a moderate-severity, availability-only denial-of-service issue, and the signals are internally consistent rather than conflicting. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 6.5) correctly reflects a network-reachable, low-complexity attack that requires an authenticated account (PR:L) holding the specific manage_index_templates cluster privilege, with impact confined to availability (A:H; C:N/I:N - no data exposure or tampering). No EPSS score, CISA KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the realistic risk is therefore 'elevated but not emergency.' The key limiting factor is the privilege requirement: manage_index_templates is a meaningful, non-default cluster privilege typically held only by trusted operators or integrations, which sharply reduces the population of potential attackers compared to a PR:N flaw. This is better characterized as an abuse-of-privilege / insider-or-compromised-credential risk than a broadly exploitable remote vulnerability. The absence of EPSS/KEV/POC data is a gap, not a contradiction - it should be interpreted as 'no exploitation evidence available' rather than 'confirmed low risk.'

An attacker who has obtained an Elasticsearch account with the manage_index_templates cluster privilege (e.g. via a compromised operator credential or an over-privileged integration) registers many template resources, each carrying a metadata field just under the per-resource size limit. They then issue a single request to retrieve all templates together, forcing the node to materialize every metadata value in memory simultaneously, exhausting the JVM heap and crashing the node with an out-of-memory error. No public exploit code was identified at time of analysis, and the attack requires valid privileged credentials rather than anonymous access.