CVE-2026-78607 is a medium severity (CVSS 5.4) missing authorization flaw in the Elasticsearch custom inference service. A user with only inference execution privileges could steer outbound traffic to a destination of their choosing and expose administrator provisioned credentials. Elastic fixed it in 8.19.19, 9.3.8, 9.4.4 and 9.5.1.
What's affected
- Elasticsearch 8.x from 8.0.0 up to and including 8.19.18.
- Elasticsearch 9.x from 9.0.0 up to and including 9.3.7, from 9.4.0 up to and including 9.4.3, and version 9.5.0.
- Affected configuration: deployments using the custom inference service type with secret backed configuration, where users hold inference execution privileges.
- Fixed in 8.19.19, 9.3.8, 9.4.4 and 9.5.1. Elastic says Cloud Serverless was patched before disclosure.
Record severity: CVSS 5.4 (medium), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The weakness class is CWE-862, Missing Authorization.
How to check if you're exposed
Find your cluster version by calling the root endpoint of the cluster with your usual credentials and reading the version number field. Then list your inference endpoints and see whether any use the custom service type with secret backed settings, and which roles can execute inference. Elastic found no specific indicators of compromise and offers no workaround, so the version check is the main test.
What to do now
- Read the version of each Elasticsearch cluster, including dev and staging.
- Upgrade to 8.19.19, 9.3.8, 9.4.4 or 9.5.1 or later in the matching series.
- Inventory custom inference endpoints and the roles allowed to run them.
- Grant inference execution privileges only to users who need them.
- Consider rotating credentials stored for custom inference endpoints if untrusted users had access.
Why it matters
Missing authorization (CWE-862) means the service did not check whether a caller was allowed to do something the caller could reach. Here, the right to run inference was enough to influence where requests went, and the request carried secrets the administrator had set up.
The score is moderate because the attacker needs an account with some privilege. Even so, credentials for outside model providers are valuable, and a low privilege role is often handed to applications and analysts. Elastic lists no known indicators of compromise, and the record does not mark the CVE as exploited in the wild.
Quick check
Does a workaround exist?
Elastic says there are no workarounds for users who cannot upgrade.
Is Elastic Cloud Serverless affected?
Elastic says it was remediated before public disclosure.
Sources
To see where this and other CVEs sit in your own dependencies, try the free in-browser scan at gold.safeguard.sh/scan.
Last reviewed: 18 October 2026.
