{"id":"CVE-2026-72649","aliases":["AZL-98451","BIT-elasticsearch-2026-72649","EUVD-2026-69562","GHSA-5fhg-p2p3-wmjf"],"status":"published","title":"Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution","description":"Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface than intended. Exploitation requires an authenticated user with sufficient privileges to create and deploy trained models.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00918,"percentile":0.60715,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2026-09-01T19:20:17Z","modified":"2026-10-28T11:22:50Z","fixes":[{"ecosystem":"Bitnami","package":"elasticsearch","fixed_in":["8.19.20","9.4.5","9.5.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"rubygem-elasticsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"8.9.0-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"elasticsearch","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.19.20"},{"introduced":"9.0.0"},{"fixed":"9.4.5"},{"introduced":"9.5.0"},{"fixed":"9.5.1"}]}]}],"products":[{"vendor":"elastic","product":"elasticsearch"}],"references":[{"url":"https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-114/390087","tags":["Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72649","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-5fhg-p2p3-wmjf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72649.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-72649","title":"Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution","description":"Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface than intended. Exploitation requires an authenticated user with sufficient privileges to create and deploy trained models.","status":"published","published":"2026-09-01T19:20:17.955Z","modified":"2026-09-02T03:55:56.675Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:19:52.016971Z"}],"euvd":[{"id":"EUVD-2026-69562","description":"Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface than intended. Exploitation requires an authenticated user with sufficient privileges to create and deploy trained models.","status":"published","published":"2026-09-01T19:20:17Z","modified":"2026-09-02T03:55:56Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:16.444637Z"}],"ghsa":[{"id":"GHSA-5fhg-p2p3-wmjf","title":"Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can...","description":"Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface than intended. Exploitation requires an authenticated user with sufficient privileges to create and deploy trained models.","status":"published","published":"2026-09-01T21:31:47Z","modified":"2026-09-01T21:31:51Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:11:14.651489Z"}],"nvd":[{"id":"CVE-2026-72649","description":"Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface than intended. Exploitation requires an authenticated user with sufficient privileges to create and deploy trained models.","status":"published","published":"2026-09-01T20:17:16.853Z","modified":"2026-09-02T18:49:54.593Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:12:43.04945Z"}],"osv":[{"id":"CVE-2026-72649","title":"Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution","description":"Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface than intended. Exploitation requires an authenticated user with sufficient privileges to create and deploy trained models.","status":"published","published":"2026-09-01T19:20:17.955Z","modified":"2026-10-28T11:22:50.515895674Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:45:15.88521Z"},{"id":"AZL-98451","title":"CVE-2026-72649 affecting package rubygem-elasticsearch 8.9.0-1","description":"Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface than intended. Exploitation requires an authenticated user with sufficient privileges to create and deploy trained models.","status":"published","published":"2026-09-01T20:17:16Z","modified":"2026-09-08T05:27:28Z","updated_at":"2026-11-02T15:28:12.596039Z"},{"id":"BIT-elasticsearch-2026-72649","title":"Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution","description":"Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface than intended. Exploitation requires an authenticated user with sufficient privileges to create and deploy trained models.","status":"published","published":"2026-09-03T08:40:41.267Z","modified":"2026-09-08T08:47:15.63366661Z","updated_at":"2026-11-02T15:28:29.563843Z"}]}}