CVE-2026-78607
Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause administrator-provisioned credentials to be exposed.
CVSS-Score5.4 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NSchwachstellentyp (CWE)CWE-862
Herstellerelastic
Betroffene Produkte
| Hersteller | Produkt | Versionen |
|---|---|---|
| elastic | elasticsearch | < 8.19.19 |
Verwandte Artikel
This product uses the NVD API but is not endorsed or certified by the NVD.