# CVE-2026-103009: Elasticsearch authorization bypass in cross-cluster search

Source: https://junglewise.ai/threats/cve-2026-103009-authorization-bypass-through-user-controlled-key-cwe-639-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-103009 · Severity: high · CVSS 7.1 · Published 2026-10-06

Elasticsearch, a search and analytics platform, contains an authorization flaw in its cross-cluster search feature that allows users with restricted API keys to access unauthorized data. An attacker with limited search permissions can craft a specially crafted request to view documents, field mappings, and metadata from indices they should not be able to access. This exposes sensitive data across Elasticsearch deployments that use Remote Cluster Security 2.0 for cross-cluster communication.

Technologies: [Elasticsearch](https://junglewise.ai/threats/technologies/elasticsearch). Vendors: [Elastic](https://junglewise.ai/threats/vendors/elastic).

## Quick answers

**Is CVE-2026-103009 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103009 being exploited in the wild.

**How severe is CVE-2026-103009?** High severity, with a CVSS score of 7.1, published 6 October 2026.

**Which products and versions are affected?** Elasticsearch 8.13.0 to 8.19.22; 9.0.0 to 9.4.7; 9.5.0 to 9.5.4.

**Is there a fix for CVE-2026-103009?** Yes: fixed in Elasticsearch 8.19.23, 9.4.8, 9.5.5. Until then: If cross-cluster search using RCS 2.0 is not required, disable remote cluster connections on the fulfilling cluster to eliminate exposure to this issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-103009 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-103009?** Check whether you run Elasticsearch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Elasticsearch 8.19.23, 9.4.8, 9.5.5

If cross-cluster search using RCS 2.0 is not required, disable remote cluster connections on the fulfilling cluster to eliminate exposure to this issue.

## Technical details

The vulnerability is an authorization bypass (CWE-639) in Elasticsearch's cross-cluster search handling under RCS 2.0 model. An authorization check validates against one shard identifier while a separate identifying attribute determines actual access, allowing an authenticated user with a cross-cluster API key to supply mismatched identifiers and access unauthorized indices. The attack requires network access to the remote cluster transport port and valid API credentials; only the fulfilling cluster in a cross-cluster setup is affected, and the REST API is not exploitable.

## Affected products

- Elastic Elasticsearch 8.13.0 to 8.19.22; 9.0.0 to 9.4.7; 9.5.0 to 9.5.4

## Timeline

- 2026-10-06: disclosed

## References

- [https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-199/390874](https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-199/390874)

## Related threats

- [Elasticsearch denial of service in phonetic analysis encoders](https://junglewise.ai/threats/cve-2026-115715-allocation-of-resources-without-limits-or-throttling-cwe-770-in)
- [Elasticsearch cache information disclosure via field-level security bypass](https://junglewise.ai/threats/cve-2026-115710-use-of-cache-containing-sensitive-information-cwe-524-in)
- [Elasticsearch incorrect authorization in field-level security](https://junglewise.ai/threats/cve-2026-115298-incorrect-authorization-cwe-863-in-elasticsearch-can-lead-to)
- [Elasticsearch uncontrolled recursion denial of service](https://junglewise.ai/threats/cve-2026-115290-uncontrolled-recursion-cwe-674-in-elasticsearch-can-lead-to)
- [Elasticsearch uncontrolled recursion denial of service in scripted runtime fields](https://junglewise.ai/threats/cve-2026-103008-uncontrolled-recursion-cwe-674-in-elasticsearch-can-lead-to)