CVE-2026-115710: Elasticsearch cache information disclosure via field-level security bypass

CVE-2026-115710 · Severity: medium · CVSS 4.2 · Published 2026-11-03

Elasticsearch, a search and analytics engine commonly used to store and query large datasets, can leak sensitive information when query results are cached and shared between users with different access permissions. A restricted user can discover whether documents match values in fields they are not allowed to access, and can also cause other users to receive incomplete search results. This only occurs in deployments using field-level security controls.

Technologies: Elasticsearch. Vendors: Elastic.

Quick answers

Is CVE-2026-115710 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-115710 being exploited in the wild.
How severe is CVE-2026-115710?
Medium severity, with a CVSS score of 4.2, published 3 November 2026.
Which products and versions are affected?
Elasticsearch 8.9.0–8.19.23, 9.0.0–9.4.8, 9.5.0–9.5.5.
Is there a fix for CVE-2026-115710?
Yes: fixed in Elasticsearch 8.19.24, 9.4.9, 9.5.6. Until then: Deployments unable to upgrade immediately can disable the query cache on indices searchable by field-level security-restricted users by setting the index.queries.cache.enabled index setting to false. Note that this is a static setting requiring index recreation or closure to apply, and disabling query caching may reduce search performance.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-11-03" }, { "kind": "patched", "at": "2026-11-03", "note": "Fixed versions released same day as disclosure" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115710 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-115710?
Check whether you run Elasticsearch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Elasticsearch 8.19.24, 9.4.9, 9.5.6

Deployments unable to upgrade immediately can disable the query cache on indices searchable by field-level security-restricted users by setting the index.queries.cache.enabled index setting to false. Note that this is a static setting requiring index recreation or closure to apply, and disabling query caching may reduce search performance.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-11-03" }, { "kind": "patched", "at": "2026-11-03", "note": "Fixed versions released same day as disclosure" } ]

Technical details

A cache-sharing vulnerability (CWE-524) in Elasticsearch allows query result caches to be shared between users with field-level security restrictions and unrestricted users for certain query types. An authenticated attacker with field-level restrictions can craft search requests to learn which documents match a field they cannot read by observing cached results from a prior query run by a full-access user on the same shard. The vulnerability is fixed in versions 8.19.24, 9.4.9, and 9.5.6.

Affected products

  • Elastic Elasticsearch 8.9.0–8.19.23, 9.0.0–9.4.8, 9.5.0–9.5.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.