Elasticsearch CVE-2026-103007

Exploitation requires that the cluster has the non-default, configurable delegated role-management privilege enabled AND that the attacker has been assigned that privilege with a broadly-scoped index pattern plus a role-definition setting that expands the matched index set. Limiting factors: the attacker must already be an authenticated, privileged user holding this delegated capability (PR:H) - it is not reachable by anonymous or ordinary users; default Elasticsearch deployments that never grant delegated role-management are not exploitable. No user interaction is required (UI:N) and the attack is network-reachable (AV:N), but the pre-granted privilege and non-default configuration are the decisive constraints that narrow real-world exposure well below the raw score.

This is a genuine but second-tier priority rather than a drop-everything emergency. The CVSS 3.1 base score of 7.2 (High) is driven by network reach (AV:N), low attack complexity (AC:L), and total CIA impact (C:H/I:H/A:H), but it is materially gated by PR:H - the attacker must already hold a privileged, non-default, administratively delegated role-management capability. No EPSS score was supplied, so exploitation probability cannot be quantified from the input. The CVE is not listed in CISA KEV and no public proof-of-concept is referenced, so this is 'no public exploit identified at time of analysis.' No SSVC decision data was provided. The signals are internally consistent - a high-privilege, high-impact authorization flaw - with no contradiction between the vector and the description (both point to an authenticated, network-reachable privilege-escalation path). The main risk nuance is that although the entry bar is high (a pre-granted delegated privilege), the ceiling is severe: successful exploitation reaches internal security data and can culminate in full cluster administrative control. Treat as high priority specifically for organizations that use Elasticsearch's delegated role-management feature with broadly-scoped index patterns; lower priority for default deployments that never granted this privilege.

An organization delegates limited, index-scoped role-management to a team lead so they can manage roles for their own indices, granting a broadly-scoped index pattern. The user updates their own assigned role, exploiting the scoping check's failure to account for a role-definition setting that expands the matched index set, thereby reaching restricted indices including internal security data and escalating toward full cluster admin. No public exploit code is referenced, and exploitation requires the attacker to already hold the delegated privilege (PR:H).