{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "Elasticsearch: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/elastic--elasticsearch/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/elastic--elasticsearch/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103009/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103009/",
   "title": "CVE-2026-103009 disclosed",
   "content_text": "Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of cross-cluster search requests made through the Remote Cluster Security (RCS) 2.0 model. An authorization check validates a request against one identifying attribute of the target shard, while a separate, independently-supplied identifying attribute in the same request determines which shard is actually accessed. A holder of a cross-cluster API key authorized for one index can craft a request whose two identifying attributes refer to different indices, causing the request to be authorized against an index they can access while actually operating against a different, unauthorized index. This can expose that index's document contents, field mappings, and other metadata, and in limited cases allows modification of retention-lease state on the unauthorized index.",
   "date_published": "2026-10-06T19:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103009/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103009/",
   "title": "CVE-2026-103009 fixed in Chainguard",
   "content_text": "Fixed versions: ruby3.3-elasticsearch 0, ruby3.4-elasticsearch 0, ruby4.0-elasticsearch 0.",
   "date_published": "2026-10-06T19:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103009/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103009/",
   "title": "CVE-2026-103009 fixed in Wolfi",
   "content_text": "Fixed versions: ruby3.3-elasticsearch 0, ruby3.4-elasticsearch 0, ruby4.0-elasticsearch 0.",
   "date_published": "2026-10-06T19:31:53Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103007/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103007/",
   "title": "CVE-2026-103007 disclosed",
   "content_text": "Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator delegate limited role-management capability to another user, scoped to specific indices. The authorization check that enforces this scoping does not correctly account for a role-definition setting that can expand the matched index set. A user holding this delegated privilege with a broadly-scoped index pattern can exploit this inconsistency by updating their own assigned role to gain access to indices that should remain restricted, including internal security data. This can enable further escalation up to full administrative control of the cluster.",
   "date_published": "2026-10-06T19:31:50Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103007/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103007/",
   "title": "CVE-2026-103007 fixed in Chainguard",
   "content_text": "Fixed versions: ruby3.3-elasticsearch 0, ruby3.4-elasticsearch 0, ruby4.0-elasticsearch 0.",
   "date_published": "2026-10-06T19:31:50Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-103007/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-103007/",
   "title": "CVE-2026-103007 fixed in Wolfi",
   "content_text": "Fixed versions: ruby3.3-elasticsearch 0, ruby3.4-elasticsearch 0, ruby4.0-elasticsearch 0.",
   "date_published": "2026-10-06T19:31:50Z"
  }
 ]
}