Is CVE-2026-78605 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78605 being exploited in the wild.

How severe is CVE-2026-78605?

Medium severity, with a CVSS score of 5.9, published 1 September 2026.

Which products and versions are affected?

Elasticsearch 8.18.0–8.19.19, 9.0.0–9.4.4, 9.5.0.

Is there a fix for CVE-2026-78605?

A patch was published on 2026-09-01: Fixed in versions 8.19.20, 9.4.5, and 9.5.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-78605 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-78605?

Check whether you run Elasticsearch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78605: Elasticsearch HTTP request smuggling leading to information disclosure

CVE-2026-78605 · Severity: medium · CVSS 5.9 · Published 2026-09-01

Elasticsearch, a widely-used search and analytics platform, contains a defect in how it interprets HTTP requests that can be exploited under specific proxy configurations. An attacker could craft malicious requests to obtain confidential responses intended for other authenticated users, potentially exposing sensitive business data or customer information when the service operates behind a shared load balancer or proxy.

Technologies: Elasticsearch. Vendors: Elastic.

Quick answers

Is CVE-2026-78605 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78605 being exploited in the wild.
How severe is CVE-2026-78605?: Medium severity, with a CVSS score of 5.9, published 1 September 2026.
Which products and versions are affected?: Elasticsearch 8.18.0–8.19.19, 9.0.0–9.4.4, 9.5.0.
Is there a fix for CVE-2026-78605?: A patch was published on 2026-09-01: Fixed in versions 8.19.20, 9.4.5, and 9.5.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-78605 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-78605?: Check whether you run Elasticsearch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a classic HTTP request smuggling (CWE-444) defect in Elasticsearch's HTTP/1.1 request handling that causes inconsistent interpretation of request boundaries. The attack succeeds only when an intermediate proxy or load balancer reuses persistent connections across independent client sessions, allowing an attacker to inject smuggled requests that are processed in the context of another user's authenticated connection. An unauthenticated network attacker can exploit this to retrieve confidential responses meant for other users. The issue is fixed in Elasticsearch 8.19.20, 9.4.5, and 9.5.1; for self-managed deployments, disabling backend connection reuse on proxies mitigates cross-user disclosure but does not fix the underlying HTTP framing defect.

Affected products

Elastic Elasticsearch 8.18.0–8.19.19, 9.0.0–9.4.4, 9.5.0

Timeline

2026-09-01: disclosed
2026-09-01: patched: Fixed in versions 8.19.20, 9.4.5, and 9.5.1

References

https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-141/390092

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.