CVE-2026-115298 | Elastic Elasticsearch up to 8.19.23/9.4.8/9.5.5 Field-level security constant_keyword authorization

November 3, 2026 Yanac

A vulnerability has been found in Elastic Elasticsearch up to 8.19.23/9.4.8/9.5.5 and classified as problematic. Affected by this issue is some unknown functionality of the component Field-level security. The manipulation of the argument constant_keyword leads to incorrect authorization.

This vulnerability is referenced as CVE-2026-115298. Remote exploitation of the attack is possible. No exploit is available.

The affected component should be upgraded.VulDB Recent EntriesRead More