CVE-2026-78607: 
Elasticsearch vulnerability analysis and mitigation

CVE-2026-78607 is a Missing Authorization (CWE-862) vulnerability in the Elasticsearch custom inference service that enables information disclosure via Privilege Abuse (CAPEC-122). An authenticated user holding only inference execution privileges can redirect outbound inference traffic to an attacker-controlled destination and expose administrator-provisioned credentials. The vulnerability affects Elasticsearch versions 8.0.0–8.19.18, 9.0.0–9.3.7, 9.4.0–9.4.3, and 9.5.0. It was published on September 1, 2026, with patches released the same day. The CVSS v3.1 base score is 7.1 (High) (GitHub Advisory, Elastic Advisory).

The root cause is CWE-862 (Missing Authorization) in Elasticsearch's custom inference service, where insufficient authorization checks allow a low-privileged user to manipulate inference endpoint configurations. An authenticated attacker with only inference execution privileges can abuse this gap to redirect outbound inference traffic to an arbitrary, attacker-controlled destination — a form of server-side request redirection. This redirection causes the Elasticsearch service to transmit administrator-provisioned credentials (e.g., API keys or secrets configured for the inference endpoint) to the attacker's server. No user interaction is required, and the attack is conducted entirely over the network (GitHub Advisory, Elastic Advisory).

Successful exploitation results in high confidentiality impact through the exposure of administrator-provisioned credentials (such as API keys or service account secrets) and low integrity impact due to the ability to redirect inference traffic. An attacker who obtains these credentials could use them for lateral movement, unauthorized access to downstream AI/ML services, or further privilege escalation within the environment. Availability is not directly impacted, but the compromise of administrative credentials could have cascading effects across integrated services (GitHub Advisory, Elastic Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.165%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access with at minimum inference execution privileges, limiting the attack surface to internal or compromised users (Elastic Advisory).

1. Reconnaissance: Identify a target Elasticsearch instance running a vulnerable version (8.0.0–8.19.18, 9.0.0–9.3.7, 9.4.0–9.4.3, or 9.5.0) with the custom inference service enabled.
2. Obtain low-privileged access: Acquire credentials for an account with inference execution privileges (e.g., a service account or compromised user with monitor_inference or equivalent role).
3. Set up attacker-controlled server: Deploy a server capable of receiving HTTP requests and logging headers/body content, including any authorization tokens or API keys transmitted by Elasticsearch.
4. Manipulate inference endpoint configuration: Using the Elasticsearch Inference API, craft a request that modifies or creates a custom inference endpoint pointing to the attacker-controlled server URL, exploiting the missing authorization check.
5. Trigger inference execution: Initiate an inference request against the manipulated endpoint, causing Elasticsearch to send outbound traffic — including administrator-provisioned credentials — to the attacker's server.
6. Harvest credentials: Collect the exposed credentials from the attacker-controlled server logs and use them to access downstream services or escalate privileges (GitHub Advisory, Elastic Advisory).

• Network: Unexpected outbound HTTP/HTTPS connections from the Elasticsearch server to unfamiliar or external IP addresses/domains, particularly originating from inference service processes; traffic containing Authorization headers or API key material sent to non-approved endpoints.
• Logs: Elasticsearch audit logs showing inference API calls (e.g., PUT /_inference/ or POST /_inference/) by low-privileged users modifying endpoint configurations; repeated inference execution requests to newly created or modified custom endpoints.
• Configuration: Unexpected or unauthorized custom inference endpoint definitions in Elasticsearch configuration, particularly those pointing to external or unknown URLs.
• Process: Elasticsearch service making outbound connections to destinations not matching any approved inference provider (e.g., OpenAI, Cohere, or internal ML services) (Elastic Advisory).

Elastic has released patched versions addressing this vulnerability: 8.19.19, 9.3.8, 9.4.4, and 9.5.1. Organizations should upgrade to one of these versions immediately. As an interim measure, restrict inference execution privileges to only trusted users who genuinely require this functionality, and audit existing inference service configurations and credential usage patterns for signs of unauthorized access or traffic redirection (Elastic Advisory, GitHub Advisory).

The vulnerability was covered in the context of Microsoft's September 2026 Patch Tuesday roundup by BleepingComputer, though it is an Elastic-originated issue (BleepingComputer). Threat intelligence aggregators such as VulDB and radar.offseq.com catalogued the vulnerability shortly after disclosure. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking coverage.