CVE-2026-78607
Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause administrator-provisioned credentials to be exposed.
Score CVSS5.4 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NType de faiblesse (CWE)CWE-862
Éditeurselastic
Produits concernés
| Éditeurs | Produit | Versions |
|---|---|---|
| elastic | elasticsearch | < 8.19.19 |
Articles liés
This product uses the NVD API but is not endorsed or certified by the NVD.