CVE-2026-72649: Elastic Elasticsearch RCE Vulnerability

CVE-2026-72649 Overview

CVE-2026-72649 is a deserialization vulnerability in the Elasticsearch machine learning component. The flaw allows an authenticated user with sufficient privileges to deploy a specially crafted trained model artifact and execute attacker-controlled logic. The issue is categorized under CWE-502 (Deserialization of Untrusted Data) and maps to CAPEC-586 (Object Injection). Elastic addressed the flaw in Elasticsearch 8.19.20, 9.4.5, and 9.5.1 as part of security advisory ESA-2026-114.

Critical Impact
Authenticated attackers with machine learning model deployment privileges can achieve remote code execution on Elasticsearch nodes, exposing indexed data and cluster integrity.

Affected Products

Elastic Elasticsearch versions prior to 8.19.20
Elastic Elasticsearch 9.x versions prior to 9.4.5
Elastic Elasticsearch 9.5.0

Discovery Timeline

2026-09-01 - CVE-2026-72649 published to the National Vulnerability Database
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-72649

Vulnerability Analysis

The vulnerability resides in how the Elasticsearch machine learning component processes trained model artifacts. When a user deploys a model, Elasticsearch deserializes the model artifact into runtime objects. The deserialization path does not sufficiently constrain the object graph or system-call surface available to the resulting code. An attacker who crafts a malicious model artifact can inject objects that execute attacker-controlled logic during or after deserialization.

Exploitation grants the attacker code execution within the Elasticsearch process context on the target node. This exposes indexed data, cluster credentials, and any secrets accessible to the service account running Elasticsearch. Because trained models can be deployed across data nodes, a single crafted artifact can affect multiple hosts in a cluster.

Root Cause

The root cause is insecure deserialization of trained model artifacts within the machine learning subsystem. The deserialization logic operates with a broader system-call surface than the intended sandbox for model inference. This allows object injection primitives to escape the constraints normally enforced on model execution and reach general-purpose runtime operations.

Attack Vector

The attack requires network access to the Elasticsearch API and authenticated credentials with privileges to create and deploy trained models. Attackers typically obtain such privileges through compromised operator accounts, stolen API keys, or overly permissive role assignments in analytics workflows. Once authenticated, the attacker uploads a crafted model artifact and triggers deployment. The deserialization occurs server-side, causing the embedded payload to execute with the privileges of the Elasticsearch service.

No verified public proof-of-concept exploit is available at time of publication. See the Elastic Security Update ESA-2026-114 for vendor technical details.

Detection Methods for CVE-2026-72649

Indicators of Compromise

Unexpected PUT _ml/trained_models/{model_id} or model deployment API calls from users or service accounts that do not normally manage machine learning workloads.
Elasticsearch JVM processes spawning child processes such as shells, curl, wget, or scripting interpreters.
Outbound network connections from Elasticsearch nodes to unfamiliar destinations shortly after model deployment events.
New or modified files under Elasticsearch data or plugin directories that were not introduced by a package update.

Detection Strategies

Audit Elasticsearch security logs for trained model create, update, and deploy actions, correlating each event to an approved change ticket.
Alert on process lineage where the Elasticsearch JVM is the parent of interactive shells or network utilities.
Baseline the set of principals authorized to invoke _ml/trained_models endpoints and flag deviations.

Monitoring Recommendations

Forward Elasticsearch audit logs and host process telemetry to a centralized analytics platform for correlation.
Monitor egress traffic from cluster nodes and flag connections that do not match known replication or ingestion peers.
Track version inventory across the fleet to confirm patched builds are deployed on every node.

How to Mitigate CVE-2026-72649

Immediate Actions Required

Upgrade all Elasticsearch nodes to 8.19.20, 9.4.5, 9.5.1, or later as specified in ESA-2026-114.
Review and reduce the set of users and API keys holding manage_ml or equivalent privileges to the minimum required.
Rotate credentials for any accounts that could deploy trained models, especially long-lived API keys.
Inspect recent trained model deployments for artifacts of unknown provenance and remove untrusted models.

Patch Information

Elastic published fixed builds in Elasticsearch 8.19.20, 9.4.5, and 9.5.1. Full release details are in the Elastic Security Update ESA-2026-114.

Workarounds

Restrict role assignments so that only trusted operators hold cluster privileges required to create or deploy trained models.
Disable the machine learning feature in cluster settings where it is not in active use until patching is complete.
Segment Elasticsearch management APIs behind network controls that limit access to trusted administrative networks.
Require multi-factor authentication and short-lived credentials for administrative access to Elasticsearch.

bash

# Configuration example: disable ML on nodes where it is not required
# elasticsearch.yml
xpack.ml.enabled: false