Elasticsearch CVE-2026-103006

Exploitation requires an authenticated account with at least read access to a single index - this is the hard prerequisite and the primary limiting factor (PR:L), so fully unauthenticated attackers cannot trigger it. The attacker must reach the Elasticsearch search API over the network and submit a request to the aggregation feature containing deeply nested aggregation definitions. No user interaction, non-default configuration, or specific platform is required beyond having the aggregation-capable search API exposed to the authenticated principal; the aggregation feature is standard functionality. The main defensive levers are restricting who holds index read/search privileges, network-isolating the cluster from untrusted users, and applying the fixed versions referenced in ESA-2026-196 (8.19.21 / 9.4.6 / 9.5.2).

This is a moderate-severity availability-only flaw whose signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) indicates network reachability and low attack complexity but requires low privileges (PR:L) - the description confirms an authenticated user with read access to just one index, a low bar in many multi-tenant or broadly-provisioned clusters. Impact is confined to availability (C:N/I:N/A:H): a single crafted request can crash a node that does not self-recover, requiring manual intervention. There is no CISA KEV listing and no EPSS score or public POC supplied in the input, so exploitation status is 'no public exploit identified at time of analysis'; the absence of these signals is not evidence of safety but does argue against widespread opportunistic exploitation today. Net assessment: this is a real but mid-tier priority - not a critical RCE, but the low privilege requirement, trivial complexity, and non-self-healing node termination make it a credible DoS risk worth prompt patching in exposed or multi-tenant Elasticsearch deployments, below any RCE/KEV items but above purely theoretical high-CVSS issues.

An authenticated user holding only read access to one index sends a single search API call whose aggregation definition is deeply nested, triggering unbounded recursion in Elasticsearch's aggregation parser. The affected node exhausts its resources and terminates, and because it does not recover automatically, an operator must manually restart it to restore service. No public exploit code was identified in the provided data, though the crafted request is simple to construct given low attack complexity.