CVE-2026-72684

CVE-2026-72684 is a memory exhaustion vulnerability in Elasticsearch where a read-only user can trigger fatal out-of-memory conditions on a node with a small, crafted search request. The CVSS 6.5 score badly understates the risk — the real issue isn't the node crash, it's the collapse of a fundamental privilege assumption: that read-only users are safe actors in the resource consumption dimension, not just the data modification dimension. Read-only access in Elasticsearch carries implicit trust assumptions that were never hardened against adversarial use. The memory accounting controls that exist operate outside the core search evaluation path — they were retrofitted as a layer around existing components rather than integrated into them. A small request bypasses the accounting layer precisely because it was never designed to see allocation happening in the legacy search evaluation code. This is the signature of a bypass, not a simple oversight: the defensive control wasn't missing, it was architected with a trust assumption that read-only users wouldn't target infrastructure availability. What makes this exploitable is the combination of low request volume and high impact. An attacker doesn't need to flood the system — they need precision. A single authenticated read-only user can kill a node, and the OOM kill provides no user-level attribution in standard Elasticsearch logging. In multi-tenant deployments, this creates a weaponized resource exhaustion profile with plausible deniability: you can trigger cluster instability and vanish into the crash log. The cascading failure potential is unmeasured by the CVSS score. A node holding primary shards triggers recovery and rebalancing across the cluster when it dies, pushing adjacent nodes toward their own limits. The recovery mechanism itself runs under the same unchallenged assumption that internal operations are benign. Audit your read-only paths for similar bypass potential: check which search components were excluded from the memory accounting layer's scope and why. If scope was determined by 'what we can easily instrument' rather than documented threat coverage, assume other legacy components sit in the same undefined space. Prioritize read-only user quotas on memory allocation even if it impacts query performance — the architectural commitment must be that read-only means hard resource bounds regardless of input content, not relaxed limits for trusted users.

Reviewed through automated stages and approved by a human before publication.