CVE-2026-72638

This CVE exposes a fundamental misalignment in how Elasticsearch's permission model treats configuration features. The vulnerability isn't simply that a low-privilege user can crash a node—it's that index creation, a permission-scoped write operation, can register persistent objects (custom analyzers) that execute recursively at query time. The permission model scopes the write but never scopes the computational footprint of what that write produces. The attack vector is custom analyzer pipeline resolution. When you create an index with a custom analyzer definition containing recursive references—tokenizer A calling tokenizer B calling tokenizer A, or unbounded char_filter chains—the analysis resolver attempts to expand these references recursively until the thread stack exhausts. This is CWE-674 (Uncontrolled Recursion), and it exploits a gap between what Elasticsearch considers a data-configuration operation versus what that configuration actually does at execution time. The practical risk is real. A single authenticated user can crash a data node. In a production cluster, that crash triggers shard reallocation, replication lag, and potential cascading degradation across dependent pipelines that depend on search availability. The EPSS score of 0.00289 likely reflects DoS deprioritization, but the exploitation path is trivial: any user with index creation permissions can submit a malformed analyzer in a standard index creation request. What you should do now: First, audit your cluster for any custom analyzer definitions in existing indices—check index settings for custom tokenizers, char_filters, and filters with recursive or circular references. Second, restrict index creation permissions aggressively; if users don't need to create custom analyzers, remove that capability entirely. Third, monitor for node crashes with stack overflow signatures in your logs—these are the indicator of active exploitation. Fourth, treat this as a class of vulnerability: any feature accepting user-defined configuration that resolves through interpreter-like paths (ingest pipelines, script templates, index templates) is a candidate for the same failure mode. The deeper lesson is that configuration features are attack surface. Elasticsearch's permission model implicitly trusted that index creation was a data organization capability, not a system stability lever. That assumption is now demonstrably false.

Reviewed through automated stages and approved by a human before publication.