Insufficient Authorization in Elasticsearch Affects Data Security

CVE-2026-56144

What is CVE-2026-56144?

Elasticsearch is vulnerable due to improper authorization mechanisms in its ingest simulation feature. This allows an authenticated user with limited index privileges to exploit these insufficient controls. By targeting restricted indices, the user can initiate configured ingest pipelines, leading to potential exposure of sensitive data processed by these pipelines. Moreover, this exploit enables unauthorized retrieval of index mapping metadata, amplifying security risks for affected systems.

References