Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-10-06T19:31:37 elasticsearch: elasticsearch: unauthorized data modification via Modify Data Streams API 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CWE-639

Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with sufficient privileges over a single resource could use the Modify Data Streams API to modify a data stream to which they were not otherwise authorized, potentially injecting data into it or affecting its ability to be searched normally. This issue does not allow an attacker to read the contents of a data stream they do not otherwise have access to.

A flaw was found in Elasticsearch. An authenticated user with permissions for at least one resource can exploit improper access controls in the Modify Data Streams application programming interface (API) to alter unauthorized data streams. Successful exploitation allows the user to inject data or disrupt search functionality within those streams, though it does not allow reading unauthorized data.

This vulnerability is rated as Moderate severity because exploitation requires an authenticated attacker who already possesses valid privileges within the cluster, and it does not grant unauthorized read access to sensitive index data. While an authenticated user can leverage the Elasticsearch Modify Data Streams API to alter data streams outside their intended boundary—potentially corrupting ingestion or impairing search operations—confidentiality of the underlying data is unaffected. Red Hat products incorporating Elasticsearch typically isolate cluster endpoints to trusted operational workflows, further limiting exposure. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-feature-server-rhel9 Red Hat Quay 3 Not affected quay/quay-rhel8 Red Hat Quay 3 Not affected quay/quay-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-102407 https://nvd.nist.gov/vuln/detail/CVE-2026-102407 https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-188/390861