Elasticsearch CVE-2026-72678

The attacker must hold valid Elasticsearch credentials with at least read-level privileges on the cluster - unauthenticated exploitation is not possible given the CVSS vector PR:L. No elevated administrative roles are required; a standard read-only API key or user account is sufficient. No special cluster configuration, plugin, or feature flag needs to be enabled; the vulnerable code path is reached through a standard product API endpoint available in default deployments. The primary limiting factor is possession of any valid read credential. Exploitation is bounded to availability impact on the targeted node - data confidentiality and integrity are not affected. In a well-configured multi-node cluster with replica shards, the cluster may continue serving queries after the node restarts, limiting the outage window, but repeated exploitation can degrade the cluster below quorum.

The CVSS 6.5 (medium) base score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H accurately characterizes the core exposure: network-reachable, low complexity, no user interaction required, with full availability impact limited to the attacked node. The low-privilege requirement (PR:L) is the primary exploitation gate, but in practice Elasticsearch read credentials are often broadly distributed across application service accounts, dashboarding tools, and developer workstations, making the effective attacker pool considerably wider than the CVSS score alone implies. The non-volumetric character of the attack - no sustained flood, no rate-limit bypass needed - means that even a mid-sized municipal IT team in gdynia operating a shared cluster should treat this as urgent if read credentials are distributed beyond a small, trusted group. No EPSS probability is available for this CVE at time of analysis, and it does not appear in CISA KEV, indicating no confirmed widespread active exploitation yet. The scope is limited to availability (C:N/I:N), so confidential data is not at direct risk, but node termination in a single-node or under-redundant cluster equates to full service outage. Organizations with high-availability multi-node clusters and strict credential hygiene face lower real-world impact than those running minimal-replica deployments.

An attacker who has obtained read-only Elasticsearch credentials - via credential stuffing, a leaked service account secret, or insider access - sends a single HTTP request to a product API endpoint with a crafted size parameter containing an extremely large integer value. Elasticsearch passes the value directly to an internal allocation routine without bounds checking, the JVM attempts to reserve the requested memory, heap is exhausted, and the node process exits with a fatal out-of-memory error, taking the node offline. No exploit code has been publicly identified at time of analysis, but the attack logic is straightforward to reconstruct from the description alone.