CVE-2026-92468: Microservices-Platform Auth Bypass Vulnerability

CVE-2026-92468 Overview

CVE-2026-92468 is an authorization bypass vulnerability [CWE-639] in the zlt2000 microservices-platform through version 6.0.0. The flaw resides in the search-center service, which accepts an Elasticsearch index name as a path variable without enforcing access controls. Authenticated attackers can query arbitrary indices by sending crafted requests to POST /search/{indexName} or GET /agg/requestStat/{indexName}/{routing}. This allows retrieval of sensitive data from restricted indices, including the sys_user index containing user records and password hashes.

Critical Impact
Any authenticated user can read arbitrary Elasticsearch indices, exposing user credentials and password hashes stored in sys_user.

Affected Products

zlt2000 microservices-platform through 6.0.0
search-center service component (SearchController, AggregationController)
Deployments exposing the search endpoints to authenticated users

Discovery Timeline

2026-09-16 - CVE-2026-92468 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92468

Vulnerability Analysis

The search-center service in microservices-platform exposes two REST endpoints that accept an Elasticsearch index name as a URL path variable. The SearchController at POST /search/{indexName} executes a full-text search against the caller-supplied index. The AggregationController at GET /agg/requestStat/{indexName}/{routing} performs aggregation queries against the same caller-supplied index. Neither controller validates whether the authenticated principal is authorized to access the requested index. Any user with valid credentials can substitute an arbitrary value for {indexName} and read data outside their intended scope.

Root Cause

The controllers implement authentication but omit object-level authorization checks. This pattern maps to CWE-639, Authorization Bypass Through User-Controlled Key. The application trusts the index name provided in the request path and passes it directly to the Elasticsearch client. There is no allowlist, tenant mapping, or role-to-index binding enforced before executing the query.

Attack Vector

An attacker with any valid account authenticates to the platform and obtains a session or bearer token. The attacker then issues a request to POST /search/sys_user or GET /agg/requestStat/sys_user/{routing}. The service returns records from the sys_user index, which stores administrative user accounts and password hashes. The attacker can enumerate other internal indices using the same technique to harvest business data. Public proof-of-concept scripts demonstrate both endpoints against a running instance. See the VulnCheck Advisory for Microservices and the GitHub PoC for C24 Search for technical details.

// No verified exploit code included. See linked PoCs for reproduction details.

Detection Methods for CVE-2026-92468

Indicators of Compromise

Requests to POST /search/sys_user or any sensitive index name from non-administrative accounts
Requests to GET /agg/requestStat/{indexName}/{routing} where {indexName} references internal or credential-bearing indices
Elasticsearch query logs showing a single user account reading multiple unrelated indices in a short window
Outbound transfers of large search-response payloads from the search-server process

Detection Strategies

Enable request logging on the search-center service and alert on path variables matching indices such as sys_user, sys_role, or other privileged indices
Correlate authenticated user identity with the {indexName} accessed and flag deviations from expected tenant or role scope
Baseline Elasticsearch index access patterns per service account and alert on new index reads

Monitoring Recommendations

Forward reverse proxy and application logs from search-server into a centralized analytics platform for query pattern analysis
Monitor authentication events tied to accounts that subsequently issue /search/* requests against multiple indices
Track HTTP response sizes on the search endpoints to identify bulk data extraction

How to Mitigate CVE-2026-92468

Immediate Actions Required

Restrict network access to the search-center service so only trusted upstream services can reach /search/* and /agg/* endpoints
Rotate credentials and password hashes stored in the sys_user index and force a password reset for all accounts
Audit Elasticsearch access logs for prior unauthorized index reads across the affected version range
Disable or gateway-block the vulnerable endpoints until an authorization layer is deployed

Patch Information

No vendor-supplied patch is referenced in the advisory at publication. Operators should track the GitHub Microservices Platform Repository for updates and review the vulnerable controllers at the GitHub Search Controller Code and GitHub Aggregation Controller Code.

Workarounds

Introduce a server-side allowlist mapping each authenticated role to the set of indices it may query, and reject any {indexName} outside that set
Front the search-center service with an API gateway that rewrites or validates the {indexName} path variable against the caller's tenant
Configure Elasticsearch role-based access control so the credentials used by search-server cannot read sys_user or other sensitive indices
Remove the index name from the URL path and derive it server-side from the authenticated session

bash

# Example gateway rule: reject requests targeting sensitive indices
# Nginx location block
location ~ ^/(search|agg/requestStat)/sys_user(/|$) {
    return 403;
}