CVE-2026-78607
Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause administrator-provisioned credentials to be exposed.
Punteggio CVSS5.4 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NTipo di debolezza (CWE)CWE-862
Vendorelastic
Prodotti coinvolti
| Vendor | Prodotto | Versioni |
|---|---|---|
| elastic | elasticsearch | < 8.19.19 |
Articoli correlati
This product uses the NVD API but is not endorsed or certified by the NVD.