Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-102409: Elasticsearch can be stopped by low‑privilege user

CVE-2026-102409 · published 29 days ago

Summary

A user with only basic rights in Elasticsearch can trigger a condition that crashes the Elasticsearch server. When the server stops, any applications that rely on it become unavailable, causing a service interruption. Install the latest Elasticsearch update and limit user permissions to prevent this.

What to do

Update elasticsearch to version 9.5.5.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	elastic	elasticsearch	<= 9.2.8
Bitnami	–	elasticsearch	>= 9.5.0, < 9.5.5 Fix: upgrade to 9.5.5

Original advisory text

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (CAPEC-130).

References

https://nvd.nist.gov/vuln/detail/CVE-2026-102409 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-1024... Vendor Advisory
https://discuss.elastic.co/t/elasticsearch-9-4-8-9-5-5-security-update-esa-2026-... URL

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-674Uncontrolled Recursion

Timeline

Published6 Oct 2026

Updated4 Nov 2026

First seen6 Oct 2026

Sources

CVE-2026-102409 · NVD

CVE-2026-102409 · MITRE

BIT-elasticsearch-2026-102409 · OSV

CVE-2026-102409 · OSV

Track software like this

Free during beta