CVE-2026-49090: Elastic Elasticsearch DoS Vulnerability

CVE-2026-49090 Overview

CVE-2026-49090 is an uncontrolled resource consumption vulnerability [CWE-400] in Elastic Elasticsearch. An authenticated user can submit a specially crafted bulk request that causes sustained high CPU consumption on the target node. The affected node becomes unable to process further requests, resulting in a denial of service condition.

The issue aligns with CAPEC-130 (Excessive Allocation) and requires only low-privilege authenticated access over the network. Elastic addressed the flaw in Elasticsearch 7.17.24 and 8.15.0 through security update ESA-2026-52.

Critical Impact
An authenticated attacker can render an Elasticsearch node unresponsive by sending a crafted bulk request, disrupting search and ingestion pipelines that depend on the cluster.

Affected Products

Elastic Elasticsearch versions prior to 7.17.24
Elastic Elasticsearch 8.x versions prior to 8.15.0
Deployments exposing the bulk API to authenticated users with write access

Discovery Timeline

2026-07-01 - CVE-2026-49090 published to the National Vulnerability Database
2026-07-02 - Last updated in NVD database
2026-07-02 - EPSS score published at 0.245%

Technical Details for CVE-2026-49090

Vulnerability Analysis

The vulnerability resides in the Elasticsearch bulk request handling path. Elasticsearch exposes the _bulk API endpoint to accept batched indexing, update, and delete operations. When an authenticated client submits a specially crafted bulk payload, the server enters a processing path that consumes CPU resources without appropriate bounds.

The sustained CPU load prevents the node from servicing other client requests. Search queries, ingest operations, and cluster coordination traffic can stall while the node processes the malicious payload. In a single-node deployment, this results in complete service disruption. In multi-node clusters, the impact depends on shard placement and routing.

Exploitation requires valid credentials with permission to submit bulk operations. No user interaction is required, and the attack is executed over the network against the REST API.

Root Cause

The root cause is uncontrolled resource consumption during bulk request parsing or execution. The server does not sufficiently constrain the CPU work performed for a single request, allowing a crafted input to trigger disproportionate processing relative to its size. Elastic's advisory ESA-2026-52 documents the fixed versions but does not publish exploit specifics.

Attack Vector

The attack vector is network-based against the Elasticsearch HTTP API. An authenticated user issues a POST request to /_bulk with a payload designed to maximize server-side CPU work. Any account with write privileges on a target index can submit the request. Because Elasticsearch clusters commonly serve applications with shared service accounts, a compromised application credential is sufficient to trigger the condition. Technical exploitation details are described in prose only; refer to the Elastic Security Update ESA-2026-52 for vendor guidance.

Detection Methods for CVE-2026-49090

Indicators of Compromise

Sustained CPU utilization at or near 100% on one or more Elasticsearch data nodes without a corresponding increase in normal query volume
Elasticsearch thread pool queues (write, bulk) filling or rejecting tasks while ingestion rates appear normal
HTTP 429 or 503 responses returned to legitimate clients while a single account continues submitting _bulk requests
Unusually large or malformed bulk payloads originating from a single authenticated identity

Detection Strategies

Monitor the _nodes/stats API for os.cpu.percent, thread_pool.write.rejected, and thread_pool.bulk.rejected metrics over time
Enable Elasticsearch audit logging and alert on high-frequency _bulk requests from a single principal
Correlate reverse proxy or load balancer access logs with node CPU spikes to identify the source client
Baseline normal bulk request size and rate per service account, and alert on statistical outliers

Monitoring Recommendations

Ingest Elasticsearch node metrics and audit logs into a centralized SIEM for correlation across the cluster
Track per-user request rates against the _bulk endpoint and enforce per-account thresholds
Alert on cluster health transitions to yellow or red states coinciding with CPU saturation events

How to Mitigate CVE-2026-49090

Immediate Actions Required

Upgrade Elasticsearch to version 7.17.24 or 8.15.0 or later as documented in Elastic Security Update ESA-2026-52
Audit accounts with write or create_index privileges and remove access from applications that do not require bulk ingestion
Rotate credentials for any service accounts that may have been exposed or shared broadly

Patch Information

Elastic released fixes in Elasticsearch 7.17.24 and 8.15.0. The vendor advisory ESA-2026-52 is the authoritative reference. Apply the update to all data and coordinating nodes and restart services following Elastic's rolling upgrade procedure to preserve cluster availability.

Workarounds

Restrict access to the _bulk API endpoint at the reverse proxy or ingress layer to trusted source networks
Apply role-based access control to limit bulk write privileges to specific service accounts and indices
Configure request size limits at the proxy layer and set conservative values for http.max_content_length
Deploy rate limiting on authenticated API traffic to contain a single account's ability to saturate a node

bash

# Example: restrict bulk API access via elasticsearch.yml and role definition
http.max_content_length: 50mb

# Assign minimal privileges to ingestion service accounts
POST /_security/role/limited_ingest
{
  "indices": [
    {
      "names": ["app-logs-*"],
      "privileges": ["create", "index"]
    }
  ]
}