CVE-2026-78607: Elastic Elasticsearch Information Disclosure

CVE-2026-78607 Overview

CVE-2026-78607 is a missing authorization vulnerability [CWE-862] in the Elasticsearch custom inference service. A low-privileged user holding only inference execution rights can redirect outbound inference traffic to an attacker-controlled destination. This redirection causes administrator-provisioned credentials to be transmitted to the attacker, resulting in information disclosure. Elastic published Security Update ESA-2026-143 to address the flaw across the 8.19, 9.3, 9.4, and 9.5 release lines.

Critical Impact
Authenticated users with inference execution privileges can exfiltrate administrator-provisioned credentials by pointing inference calls at an external destination they control.

Affected Products

Elastic Elasticsearch 8.x prior to 8.19.19
Elastic Elasticsearch 9.x prior to 9.3.8, 9.4.4, and 9.5.1
Elastic Elasticsearch 9.5.0

Discovery Timeline

2026-09-01 - CVE-2026-78607 published to NVD
2026-09-02 - Last updated in NVD database
ESA-2026-143 - Elastic releases security update addressing the vulnerability

Technical Details for CVE-2026-78607

Vulnerability Analysis

Elasticsearch exposes a custom inference service that lets administrators configure external model providers with pre-provisioned credentials. Regular users can then invoke inference actions without directly handling the underlying secrets. The service does not verify that a caller with inference execution privileges is authorized to change the outbound destination of an inference request.

Because the destination is user-controllable, an attacker can point inference traffic at a server they operate. When Elasticsearch dispatches the request, it attaches the administrator-provisioned authentication material intended for the legitimate provider. The receiving endpoint captures these credentials in plaintext HTTP headers or request bodies.

This pattern maps to CAPEC-122 (Privilege Abuse). The attacker uses granted, low-scope privileges to obtain higher-value secrets that the privilege model was designed to protect.

Root Cause

The root cause is a missing authorization check on the destination parameter of the custom inference service. The code path treats destination selection as a data field rather than a privileged configuration action. Inference execution rights and inference configuration rights are conflated at the enforcement layer.

Attack Vector

Exploitation requires network access to the Elasticsearch API and a valid account with inference execution privileges. No user interaction is required. The attacker submits an inference request that specifies a controlled URL as the model endpoint, then collects the credentials that Elasticsearch transmits with the outbound call.

See the Elastic Security Update ESA-2026-143 advisory for vendor-provided technical details.

Detection Methods for CVE-2026-78607

Indicators of Compromise

Outbound HTTPS connections from Elasticsearch nodes to hostnames that do not match approved inference providers.
Unexpected modifications or executions against _inference API endpoints originating from non-administrative accounts.
Inference requests referencing custom service definitions with newly seen or short-lived destination URLs.

Detection Strategies

Baseline the set of external inference endpoints Elasticsearch is authorized to contact and alert on deviations.
Correlate audit log entries showing inference executions by low-privileged users with concurrent egress traffic to unusual domains.
Inspect Elasticsearch audit logs for POST operations against _inference/* paths that specify custom URLs.

Monitoring Recommendations

Enable Elasticsearch audit logging for the security and inference categories and forward events to a central SIEM.
Monitor egress network flows from Elasticsearch data and coordinating nodes for connections to non-allowlisted destinations.
Track use of inference API tokens issued to service accounts and alert on privilege changes affecting inference roles.

How to Mitigate CVE-2026-78607

Immediate Actions Required

Upgrade Elasticsearch to 8.19.19, 9.3.8, 9.4.4, or 9.5.1 as applicable to your deployment.
Rotate any credentials that were provisioned in custom inference service configurations prior to patching.
Audit which users and roles currently hold inference execution privileges and revoke unnecessary grants.

Patch Information

Elastic released fixes in Elasticsearch 8.19.19, 9.3.8, 9.4.4, and 9.5.1 as documented in Elastic Security Update ESA-2026-143. Version 9.5.0 is explicitly affected and must be upgraded.

Workarounds

Restrict egress from Elasticsearch nodes with network policy or a proxy that allowlists approved inference provider hostnames.
Remove or disable custom inference service configurations that contain sensitive credentials until upgrade is complete.
Limit the inference execution privilege to trusted service accounts and audit role mappings for over-provisioned users.

bash

# Review users and roles holding inference privileges
curl -u elastic -XGET "https://<host>:9200/_security/role" \
  | jq '.[] | select(.cluster[]? | test("inference"))'

# List configured inference endpoints for review
curl -u elastic -XGET "https://<host>:9200/_inference/_all"