CVE-2026-72649

Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface than intended. Exploitation requires an authenticated user with sufficient privileges to create and deploy trained models.

• CWE-502

• https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-114/390087Vendor Advisory

Published

Sep 1, 2026

Last Modified

Sep 2, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-72642The native inference process that Elasticsearch uses to eval…8.8
• CVE-2026-72643Kibana Agent Builder determines whether a caller owns a priv…7.1
• CVE-2026-72644Uncaught Exception (CWE-248) in Kibana can lead to a denial …6.5
• CVE-2026-72645Memory Allocation with Excessive Size Value (CWE-789) in Ela…6.5
• CVE-2026-72647Uncontrolled Recursion (CWE-674) in Elasticsearch can lead t…6.5
• CVE-2026-72648Cleartext Storage of Sensitive Information in an Environment…6.5
• CVE-2026-7265A security vulnerability has been detected in SourceCodester…6.3
• CVE-2026-72650Authorization Bypass Through User-Controlled Key (CWE-639) i…4.3
• CVE-2026-72651Allocation of Resources Without Limits or Throttling (CWE-77…6.5
• CVE-2026-72652Allocation of Resources Without Limits or Throttling (CWE-77…6.5
• CVE-2026-72653Allocation of Resources Without Limits or Throttling (CWE-77…6.5
• CVE-2026-72654Execution with Unnecessary Privileges (CWE-250) in the Kiban…6.5