CVE-2026-102411

Executive Summary

CVE-2026-102411 is a denial-of-service vulnerability in Elasticsearch stemming from allocation of resources without limits or throttling (CWE-770). Although Elasticsearch enforces a size limit on the user-supplied metadata field for each individual template resource, it does not constrain the total memory consumed when many such resources are retrieved together. An authenticated user holding the manage_index_templates cluster privilege can register multiple resources, each within the per-resource limit, and retrieve them collectively to exhaust JVM heap and crash the affected node. The vulnerability carries a CVSS 3.1 base score of 6.5, is currently unpatched, and has no public proof-of-concept.

Technical Analysis

The flaw is a classic unbounded-resource-aggregation issue. Elasticsearch applies a per-object guardrail: each template resource's user-supplied metadata field is capped at an individual maximum size. This control assumes a bounded working set, but the aggregate retrieval path materializes the metadata values for many resources simultaneously in memory. Because no global or cumulative limit is enforced across the collection, a caller can register N resources each just under the individual threshold, then trigger a retrieval that effectively multiplies N by the per-item size. The resulting allocation can exceed the available JVM heap on the serving node.

Key properties of the flaw:

• Vulnerability class: CWE-770 (Allocation of Resources Without Limits or Throttling).
• Attack pattern: CAPEC-130 (Excessive Allocation) — the adversary deliberately drives memory consumption beyond safe capacity.
• Authentication requirement: Low privileges. The attacker must hold the manage_index_templates cluster privilege. This is an authenticated but non-administrative role, widening the internal threat surface.
• Trigger surface: The metadata field on template resources, retrieved in aggregate. Per the advisory wording, the individual size limit is enforced but the aggregate total is not.
• Impact mechanism: Memory exhaustion → out-of-memory (OOM) error → node failure → denial of service.

The root cause is the absence of cumulative accounting at the collection-retrieval boundary. A robust fix typically involves either a global cap on summed metadata across all returned resources, streaming/pagination of the materialized values, or bounding the number of resources whose metadata can be simultaneously materialized. No such guardrail is present per the description.

No public exploit code or Nuclei template exists, and no official patch reference is available. The attack chain below is therefore inferred at the vulnerability-class level rather than from disclosed exploit artifacts.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class (CWE-770 / CAPEC-130). Only identifiers explicitly named in the description (manage_index_templates, the template metadata field) are used.

1. Reconnaissance / target identification. An actor establishes access to an Elasticsearch cluster and confirms possession of (or obtains) an account with the manage_index_templates cluster privilege. This is a low-privileged, legitimate operational role — the attacker does not need administrative rights. The actor identifies an endpoint or workflow through which index templates and their metadata can be registered and retrieved.

2. Triggering the flaw. The attacker registers many template resources, each with a user-supplied metadata field sized just beneath the individual per-resource limit. Because the individual limit is the only enforced guardrail, every registration succeeds. The attacker is effectively amortizing the per-item cap across a large number of items.

3. Execution / payload method (class-level). The attacker performs an aggregate retrieval of the registered resources. The retrieval path materializes all metadata values into memory at once. With no cumulative cap, the summed allocation scales linearly with the number of registered resources and can be pushed past the node's heap ceiling. No code injection, memory-corruption, or privilege escalation is involved — the payload is simply volume.

4. Post-exploitation impact. The node fails with an out-of-memory error, resulting in a denial of service. Depending on cluster topology (shard allocation, master-eligible roles, coordinating nodes), the failure can degrade or interrupt search, indexing, and cluster coordination. Because the attacker retains the manage_index_templates privilege, the condition can be reproduced on recovery, making it a repeatable availability attack.

Impact Assessment

• Confidentiality (C:N): No data disclosure. The flaw does not expose contents to unauthorized parties.
• Integrity (I:N): No data modification vector is described.
• Availability (A:H): High. Successful exploitation produces an OOM condition and node failure — a direct, complete loss of availability for the affected node.
• Attack Vector (AV:N): Network-reachable; no adjacent or local placement required.
• Attack Complexity (AC:L): Low. The pattern (register many, retrieve together) is straightforward and repeatable.
• Privileges Required (PR:L): Low. The manage_index_templates privilege is an administrative-scoped but non-root operational role, obtainable by internal users, automation service accounts, and compromised credentials.
• User Interaction (UI:N): None. The attacker acts unilaterally.

Business impact: A degraded or crashed Elasticsearch node can take down log aggregation, observability dashboards, search functionality, and security analytics that many enterprises depend on for monitoring and incident response. Notably, a DoS against the security-analytics cluster can blind defenders. Blast radius extends beyond the affected node if it is master-eligible or holds primary shards. Secondary risk: repeatedly knocked-over nodes can corrupt operational confidence, trigger false failover churn, and monopolize on-call response.

Threat profile: Because the privilege requirement is authenticated-and-low, the realistic adversaries are malicious or disgruntled insiders, holders of leaked service-account credentials, and any attacker who has already achieved initial foothold and lateral movement into the cluster. This is not a remote-unauthenticated mass-exploitation candidate at the scale of internet-exposed misconfigurations, though internet-exposed Elasticsearch instances with weak credential hygiene remain a concern. Currently, CISA KEV does not list this CVE, there is no public exploit, and no EPSS score has been assigned by FIRST.org.

Detection Guidance

Detection must focus on the behavioral signature: a single principal registering an unusually large number of template resources, followed by a bulk/aggregate retrieval, and correlating that with JVM heap and GC degradation and OOM events on the node.

Sigma Rule

title: Elasticsearch Index Template Metadata Aggregation Abuse (CVE-2026-102411)
id: 9f2c7a14-cve2026-102411-elasticsearch
status: experimental
description: Detects a principal with manage_index_templates registering many index templates and retrieving them in aggregate, consistent with CWE-770 heap-exhaustion denial of service.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102411
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  product: elasticsearch
  service: audit
detection:
  selection_action:
    event.action:
      - 'indices:admin/template/put'
      - 'indices:admin/index_template/put'
      - 'indices:admin/template/get'
      - 'indices:admin/index_template/get'
  selection_priv:
    elasticsearch.privileges: '*manage_index_templates*'
  timeframe: 5m
  condition: selection_action and selection_priv | count(elasticsearch.user.name) by elasticsearch.user.name > 50
falsepositives:
  - Legitimate bulk template management by configuration-as-code pipelines
  - Snapshot/restore automation touching many templates
level: medium
tags:
  - attack.t1499
  - cve.2026.102411

YARA Rule

rule CVE_2026_102411_ES_Template_Metadata_Abuse
{
    meta:
        description = "Detects suspicious bulk index-template metadata payloads associated with CVE-2026-102411 resource exhaustion"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102411"
        date = "2026-01-01"
        cve = "CVE-2026-102411"
    strings:
        $a1 = "\"index_patterns\"" ascii nocase
        $a2 = "\"template\"" ascii nocase
        $m1 = "\"metadata\"" ascii nocase
        $bulk1 = "PUT _index_template/" ascii nocase
        $bulk2 = "PUT _template/" ascii nocase
    condition:
        filesize < 10MB and
        (any of ($bulk*)) and (all of ($a1, $a2, $m1))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102411 Elasticsearch Index Template Metadata Aggregation Abuse (CWE-770 DoS)"; flow:to_server,established; http.method; content:"PUT"; http.uri; content:"_index_template"; nocase; http.request_body; content:"metadata"; nocase; threshold:type both, track by_src, count 50, seconds 300; classtype:attempted-dos; reference:cve,2026-102411; metadata:created_at 2026_01_01, cve CVE_2026_102411; sid:2026102411; rev:1;)

Elastic Detection

sequence by elasticsearch.user.name with maxspan=5m
  [ any where event.action in ("indices:admin/template/put", "indices:admin/index_template/put")
      and elasticsearch.privileges like "*manage_index_templates*" ]
  [ any where event.action in ("indices:admin/template/get", "indices:admin/index_template/get") ]

Splunk SPL Query

index=elasticsearch sourcetype=elasticsearch:audit
(event.action IN ("indices:admin/template/put","indices:admin/index_template/put","indices:admin/template/get","indices:admin/index_template/get"))
OR (event.category="cluster_change" AND message="*manage_index_templates*")
| bin _time span=5m
| stats count AS template_ops values(event.action) AS actions dc(elasticsearch.template.name) AS distinct_templates BY elasticsearch.user.name _time
| where template_ops > 50 OR distinct_templates > 50
| sort - template_ops

Wazuh OSSEC Rule

<group name="elasticsearch,cve-2026-102411,">
  <rule id="102411" level="10">
    <decoded_as>json</decoded_as>
    <field name="event.action">indices:admin/index_template/(put|get)</field>
    <field name="elasticsearch.privileges">manage_index_templates</field>
    <description>CVE-2026-102411: Possible Elasticsearch index template metadata aggregation abuse (resource exhaustion DoS)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,</group>
  </rule>
  <rule id="102412" level="12">
    <if_sid>102411</if_sid>
    <field name="event.action">indices:admin/index_template/get</field>
    <description>CVE-2026-102411: Aggregate template metadata retrieval following bulk registration</description>
    <group>dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is documented.

1) Immediate mitigations

• Restrict the manage_index_templates cluster privilege to the smallest possible set of identities. Audit roles, service accounts, and API keys; remove the privilege from generic or shared accounts.
• Apply principle of least privilege across all cluster roles and enforce API key scoping; rotate credentials that may have been shared.
• Reduce the per-cluster risk by lowering template resource counts and monitoring for sudden proliferation of index templates.
• Configure JVM heap monitoring and alerting on GC pressure, heap utilization, and OOM events so responses trigger before node failure.
• Ensure Elasticsearch is not exposed to untrusted networks; behind a proxy, restrict write endpoints to authenticated internal callers.
• Enable and centralize audit logging so template registration and retrieval events are retained and alertable.

2) Patch / upgrade steps

• No official patch is currently available (patch sources empty). Monitor the Elastic security advisories and release notes channels continuously.
• Once a fixed version is published, stage it in a non-production cluster, verify template aggregation behavior, then roll out with a maintenance window.
• Because no fixed version is confirmed, treat "upgrade to latest release" as a best practice rather than a confirmed remediated version, and re-validate against vendor advisories when a patch CVE linkage appears.

3) Long-term hardening

• Enforce cumulative resource limits and quotas at the application/ingestion layer where possible, compensating for the missing aggregate guardrail.
• Deploy node-level and container-level memory limits (cgroups) to contain the blast radius of any single-node heap exhaustion.
• Implement rate limiting on administrative template operations via a gateway or custom proxy.
• Adopt continuous vulnerability monitoring (this CVE is unpatched and unlisted in CISA KEV) and maintain an inventory of Elasticsearch clusters and their exposed write paths.
• Conduct tabletop exercises for availability-based attacks against monitoring infrastructure, recognizing that DoS against observability platforms impairs incident response.

References

• NVD — CVE-2026-102411: https://nvd.nist.gov/vuln/detail/CVE-2026-102411
• MITRE CWE-770 — Allocation of Resources Without Limits or Throttling: https://cwe.mitre.org/data/definitions/770.html
• MITRE CAPEC-130 — Excessive Allocation: https://capec.mitre.org/data/definitions/130.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• Elastic Security Advisories: https://www.elastic.co/community/security
• CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-102411 is NOT currently listed)

No known exploit-in-the-wild evidence, threat actor campaign, public PoC, or Nuclei template is associated with this CVE at the time of writing. No EPSS score has been assigned by FIRST.org.