Elasticsearch EUVD-2026-93928

Exploitation requires an authenticated Elasticsearch account that already holds sufficient privileges over at least one resource (PR:L); a fully unauthorized or anonymous attacker cannot trigger it. The specific vector is the Modify Data Streams API, which fails to properly constrain which data streams the caller may alter, allowing modification of a data stream outside the user's authorized scope. Limiting factors: the flaw grants only write/modify capability (injecting data or affecting searchability) and explicitly does NOT permit reading the target stream's contents; impact is therefore confined to integrity and availability of data streams. Only running versions in the affected ranges (7.17.5-7.17.29, 8.2.2-8.19.18, 9.0.0-9.3.7, 9.4.0-9.4.3) are vulnerable.

This is a moderate-severity authorization flaw rather than a high-priority emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) indicates network-reachable, low-complexity exploitation, but PR:L means a pre-authenticated user with existing legitimate privileges over at least one resource is required - this is a privilege-boundary violation, not an open remote exploit. Impact is deliberately constrained: C:N (the vendor explicitly states no unauthorized data can be read), with only I:L (data injection/modification into a data stream) and A:L (degraded searchability), yielding the 5.4 (Medium) score. No EPSS score, KEV listing, or public POC was provided in the input, so there is no signal of active or probable exploitation; absence of these is not proof of safety but does not elevate priority. The signals are internally consistent - there is no network-vs-local conflict here - so this reads as a genuine-but-contained insider/authorized-user authorization issue, appropriate for routine patch-cycle remediation rather than emergency response. Teams running multi-tenant or least-privilege Elasticsearch clusters where users are granted scoped access should prioritize higher than single-tenant deployments where all users are already trusted.

An authenticated Elasticsearch user who holds sufficient privileges over a single resource calls the Modify Data Streams API and manipulates a data stream they were never granted access to, injecting spurious documents or impairing its searchability. No user interaction or additional authentication is needed beyond the attacker's existing account, but they cannot read the target data stream's contents. No public exploit code was identified in the provided data.