CVE details
CVE-2026-78607
Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause administrator-provisioned credentials to be exposed.
- Score
- 5.4 medium
- Published
- 2026-09-01
- Links
- NVD · cve.org · Report wrong data
Matched ports (2)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| textproc/elasticsearch8 | elasticsearch8 | 8.19.24 | fixed by update | elastic@FreeBSD.org |
| textproc/elasticsearch94 | elasticsearch94 | 9.4.9 | fixed by update | elastic@FreeBSD.org |