CVE-2026-82294
Description
A flaw was found in Elasticsearch. An authenticated remote attacker can exploit this vulnerability to trigger excessive resource allocation, leading to a Denial of Service (DoS). By sending requests that consume disproportionate system resources, an attacker can exhaust system capacity and cause the service to become unresponsive.
Statement
This vulnerability is rated as Moderate because exploitation requires authenticated network access and solely results in a denial of service without compromising system confidentiality or integrity. In Red Hat environments, including Red Hat Quay and Red Hat OpenShift AI, Elasticsearch functions as an internal data store and search backend rather than an openly exposed endpoint. An attacker with valid credentials must supply specialized queries that exhaust available node memory or compute capacity, confining the disruption to cluster availability without enabling remote code execution.
Mitigation
Restrict network exposure by limiting communication with Elasticsearch to trusted internal systems and localhost.
For host deployments using firewalld, block untrusted network access to the Elasticsearch service port (TCP port 9200) and allow only designated sources:
# firewall-cmd --permanent --zone=trusted --add-source=<trusted_ip_or_subnet>
# firewall-cmd --permanent --remove-port=9200/tcp
# firewall-cmd --reload
In containerized environments such as OpenShift, implement an ingress NetworkPolicy to permit traffic to the Elasticsearch service only from authorized application pods.
Caveat: Network restriction limits external reachability but does not prevent authenticated users within the allowed perimeter from executing resource-intensive queries. Reloading firewall configurations or applying network policies may cause a momentary interruption to active network sessions.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 6.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
