Elasticsearch CVE-2026-49090

Exploitation requires valid Elasticsearch credentials with at minimum the index privilege needed to submit bulk requests - confirmed by CVSS PR:L. The _bulk API endpoint is enabled by default in all Elasticsearch deployments and requires no non-default configuration to be reachable. No special client software or prior foothold beyond network access and authenticated credentials is required. The primary factors limiting exploitation are: (1) the attacker must hold authenticated access to the cluster, preventing unauthenticated or anonymous exploitation; (2) impact per CVSS S:U is confined to the node processing the crafted request rather than automatically cascading to all cluster nodes. No specific Elasticsearch feature flags, plugins, or configuration settings beyond standard bulk indexing access are identified as prerequisites in the available data.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H scores 6.5 (Medium), reflecting a network-accessible attack of low complexity requiring only low-privilege authentication, with full availability impact scoped to the vulnerable node. The PR:L requirement is the principal limiting factor - opportunistic unauthenticated exploitation is not possible, but service accounts with indexing rights are commonplace in Elasticsearch deployments and represent a realistic attacker foothold. Impact is scoped per S:U, meaning CVSS formally constrains damage to the individual node; in practice, a single affected node in a small cluster or a coordinating node can degrade cluster-wide availability. No KEV listing and no POC availability reduce immediate urgency. EPSS data was not provided in the input and cannot be assessed. For organizations operating Elasticsearch as a customer-facing or business-critical data platform, priority is moderate to high; for air-gapped or internal deployments with strict credential controls, risk is lower. There is no conflicting signal between the CVSS vector and the description - both consistently indicate a network-delivered, authenticated availability attack.

An attacker with access to a low-privilege Elasticsearch account - such as a compromised ingest service account or a malicious insider - submits a crafted bulk request payload engineered to maximize CPU utilization in the server-side parsing or processing path without triggering standard payload-size rejections. The targeted Elasticsearch node enters sustained high CPU saturation, causing request queuing, timeout failures, and eventual inability to serve queries or accept new indexing operations. In small clusters or deployments relying on a single coordinating node, this can produce effective cluster-wide unavailability for the duration of the attack.