Elasticsearch CVE-2026-56148

Exploitation requires a valid Elasticsearch account with at minimum query (search) privileges, confirmed by the CVSS PR:L metric. No special non-default configuration is required beyond having an authenticated session - the flaw is in the query execution path, which is enabled by default for any user with search permissions. The attack is purely availability-oriented; it cannot be used to exfiltrate data or modify documents. Exploitation is limited to single-node impact per the unchanged scope (S:U); however, repeated requests or targeting multiple nodes could progressively degrade cluster health. Anonymous or unauthenticated attackers cannot exploit this vulnerability.

The NVD-assigned CVSS 6.5 (Medium) reflects the limited impact profile: availability-only with no confidentiality or integrity loss (C:N/I:N/A:H). The PR:L requirement is the primary mitigating factor - exploitation requires a valid low-privilege account, ruling out fully anonymous attacks. Attack complexity is low (AC:L), meaning no race conditions or non-default configurations are needed beyond basic authentication. No EPSS score was provided in the input data; without it, exploitation probability cannot be quantified numerically. KEV status is absent, and no public proof-of-concept is referenced, suggesting this has not yet seen mass exploitation. The real-world risk is moderate: Elasticsearch clusters frequently grant query access to developers, applications, and service accounts, making the attacker pool broader than a strict 'privileged user' framing implies. In multi-tenant or SaaS-hosted Elasticsearch environments, any customer with query access could trigger this against shared infrastructure.

An attacker who holds any low-privilege Elasticsearch account - such as a developer with read access or an application service account - crafts a query containing deeply nested or recursively structured clauses and submits it via the standard REST API on port 9200. The query processing engine enters uncontrolled recursion, exhausting available resources until the node becomes unresponsive and drops out of the cluster. No public proof-of-concept exploit code has been identified at time of analysis.