CVE-2026-78605: Elastic Elasticsearch Information Disclosure

CVE-2026-78605 Overview

CVE-2026-78605 is an HTTP Request Smuggling vulnerability [CWE-444] affecting Elastic Elasticsearch. The flaw stems from inconsistent interpretation of HTTP requests between Elasticsearch and upstream proxies. Under specific proxy deployment configurations, a network attacker can smuggle requests through the front-end proxy and obtain confidential responses intended for other authenticated users.

Elastic addressed the issue in versions 8.19.20, 9.4.5, and 9.5.1 under advisory ESA-2026-141. The vulnerability requires a vulnerable proxy configuration in front of Elasticsearch, which raises attack complexity but does not require authentication.

Critical Impact
A network attacker can intercept confidential HTTP responses intended for other authenticated users, exposing search results, cluster data, and session-scoped information without any credentials.

Affected Products

Elastic Elasticsearch versions prior to 8.19.20
Elastic Elasticsearch 9.x versions prior to 9.4.5
Elastic Elasticsearch 9.5.0

Discovery Timeline

2026-09-01 - CVE-2026-78605 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-78605

Vulnerability Analysis

HTTP Request Smuggling exploits differences in how a front-end proxy and a back-end server parse HTTP message boundaries. When two systems disagree on where one request ends and the next begins, an attacker can prepend hidden request fragments to a legitimate victim's connection.

In CVE-2026-78605, Elasticsearch's HTTP layer parses request framing headers differently than certain proxy configurations placed in front of it. An attacker crafts a request that the proxy forwards as a single unit, but Elasticsearch interprets as two distinct requests. The smuggled fragment is then joined with a subsequent authenticated user's request, allowing the attacker to steal that user's response body.

The result is information disclosure (CAPEC-33). Confidential responses, including search results and cluster state data, can be redirected to the attacker's connection.

Root Cause

The root cause is inconsistent interpretation of HTTP request framing headers, specifically Content-Length and Transfer-Encoding, between Elasticsearch and upstream proxies. When headers conflict or contain ambiguous values, the two parsers reach different conclusions about message boundaries. This desynchronization enables the smuggling primitive.

Attack Vector

The attack is remote and unauthenticated but requires a specific vulnerable proxy deployment pattern in front of Elasticsearch. An attacker sends a crafted HTTP request containing conflicting framing headers to the proxy. The proxy forwards it as one request; Elasticsearch treats the trailing bytes as the start of the next request on the reused back-end connection. When an authenticated user's request arrives on that same connection, it is appended to the smuggled prefix, and the attacker receives the victim's response.

No exploit code is publicly available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Elastic Security Update ESA-2026-141 for vendor details.

Detection Methods for CVE-2026-78605

Indicators of Compromise

HTTP requests to Elasticsearch containing both Content-Length and Transfer-Encoding: chunked headers, or duplicated framing headers.
Unexpected POST or GET request fragments appearing in Elasticsearch access logs without matching proxy log entries.
Anomalous response-size distributions on the proxy-to-Elasticsearch connection, indicating misaligned request and response pairs.

Detection Strategies

Inspect proxy and Elasticsearch logs for divergences in request counts, methods, or URIs across the same time window.
Deploy a Web Application Firewall (WAF) rule that blocks requests presenting conflicting Content-Length and Transfer-Encoding headers.
Correlate authentication events with response destinations to identify sessions returning data to unauthenticated peers.

Monitoring Recommendations

Enable verbose HTTP request logging on Elasticsearch nodes and forward logs to a centralized analytics platform for correlation with proxy logs.
Alert on unusual Connection: keep-alive reuse patterns and unexpected pipelining behavior between proxy and Elasticsearch.
Monitor Elasticsearch audit logs for authenticated actions initiated from source IPs that never completed authentication at the proxy tier.

How to Mitigate CVE-2026-78605

Immediate Actions Required

Upgrade Elasticsearch to 8.19.20, 9.4.5, or 9.5.1 or later as directed in ESA-2026-141.
Audit proxy deployments in front of Elasticsearch for HTTP/1.1 parsing behavior and disable ambiguous header handling.
Restrict direct network access to Elasticsearch nodes so that only trusted, patched proxies can connect.

Patch Information

Elastic released fixed versions 8.19.20, 9.4.5, and 9.5.1 addressing the request smuggling flaw. Full remediation details are provided in the Elastic Security Update ESA-2026-141.

Workarounds

Configure the front-end proxy to normalize or reject requests containing both Content-Length and Transfer-Encoding headers.
Disable HTTP connection reuse (keep-alive) between the proxy and Elasticsearch to prevent cross-request contamination on shared back-end connections.
Terminate TLS and enforce strict HTTP/1.1 parsing at a compliant reverse proxy that rejects malformed framing before requests reach Elasticsearch.

bash

# Example NGINX hardening to reject ambiguous framing headers
http {
    map $http_transfer_encoding $bad_te {
        default 0;
        "~*chunked" 1;
    }
    server {
        if ($http_content_length != "") {
            set $has_cl 1;
        }
        if ($bad_te$has_cl = "11") {
            return 400;
        }
        proxy_http_version 1.1;
        proxy_set_header Connection "close";
        proxy_pass http://elasticsearch_backend;
    }
}