Information Disclosure Vulnerability in Elasticsearch by Elastic

CVE-2026-115710

What is CVE-2026-115710?

A vulnerability in Elasticsearch allows for potential information disclosure through the use of cached query results. This occurs when specially crafted search requests are made, leading to unintended sharing of data between users with varying access permissions. Users limited by field-level security restrictions may glean insights into documents based on cached query hits, despite lacking permission to view the actual content. Additionally, this issue can result in users with full access receiving incomplete or erroneous search results, particularly if a restricted user previously executed the same query on the same data shard.

References