Deserialization Vulnerability in Elasticsearch Machine Learning Component

CVE-2026-72649

What is CVE-2026-72649?

A vulnerability in the Elasticsearch machine learning component allows for the deserialization of untrusted data, potentially leading to remote code execution. This occurs via object injection vulnerabilities where a specially crafted trained model artifact can execute attacker-controlled logic. For successful exploitation, an authenticated user with sufficient privileges is required to create and deploy these trained models, which can widen the system-call surface beyond intended parameters.

References