Elasticsearch CVE-2026-72683

Exploitation requires an authenticated Elasticsearch account holding privileges specifically permitting invocation of the simulate pipeline API - concretely, a role granting manage_pipeline or an equivalent simulate-scoped privilege. This is not a default end-user permission: it is typically assigned to data engineers, ingest pipeline developers, or administrative service accounts, not to read-only data consumers or application query users. Unauthenticated access or read-only (monitor, read) roles are insufficient. The vulnerability is confined strictly to the simulate pipeline code path; standard search, indexing, or other ingest operations are unaffected. Network access to the Elasticsearch HTTP API port (default 9200/TCP) is required. Each successful exploit terminates one node process rather than the entire cluster; sustained degradation requires repeated invocation across multiple nodes.

The vendor-supplied CVSS 6.5 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately characterizes this as a network-accessible, low-complexity availability-only impact requiring only low-privilege authentication with no user interaction and no scope change. Impact is strictly limited to availability - confidentiality and integrity are unaffected, which bounds the overall severity below critical. EPSS data was not provided, so statistical exploitation probability cannot be quantified. No CISA KEV listing and no POC code have been identified, meaning no confirmed active exploitation at time of analysis. Despite the absence of a public exploit, the attack prerequisites are operationally realistic: simulate pipeline privileges are commonly held by data engineers and DevOps operators in production Elasticsearch deployments, and the attack pattern (submitting a cyclic pipeline definition) requires no advanced technique once the triggering structure is understood. In single-tenant, tightly controlled deployments the risk is contained; in multi-tenant clusters or environments with broadly distributed pipeline management roles, the risk is materially elevated since a single low-privilege account can repeatedly terminate nodes to degrade cluster availability.

An authenticated Elasticsearch user - such as a data engineer or a compromised service account with manage_pipeline permissions - posts a crafted pipeline definition containing a processor that references itself, forming a cyclic structure. When the simulate pipeline endpoint processes the request, the internal traversal component enters unbounded recursion, exhausts stack space, raises a fatal unhandled error, and terminates the node process. In a multi-node cluster the attacker repeats this against other nodes to progressively degrade cluster capacity and availability.