CVE-2026-103008

Executive Summary

CVE-2026-103008 is an uncontrolled recursion vulnerability (CWE-674) in Elasticsearch that allows an authenticated user with read access to a single index to crash a cluster node via a specially crafted request. The flaw exists in the construction and serialization of geometry values produced by scripted runtime fields, which are not subject to the nesting-depth limit applied to text-supplied geometry. Impact is denial of service (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), with affected nodes potentially requiring manual intervention to recover.

Technical Analysis

Elasticsearch supports runtime fields whose values are computed at query time. In the documented behavior, geometry values supplied as text pass through a parsing path that enforces a maximum nesting depth. The NVD description states that geometry constructed from the output of a script is not bounded by that same limit. The weakness is therefore a missing recursion-depth guard on a script-derived data path, rather than a flaw in the parser itself.

The attack surface is the runtime-field definition in a search request. An authenticated user — requiring only read access to a single index — can define a field whose script returns a deeply nested structure. When Elasticsearch builds and serializes that structure, the recursive routine descends once per nesting level with no depth cap. Once the structure exceeds the available call-stack space, stack exhaustion occurs and the affected node terminates.

Two properties raise the severity beyond a trivial query abort:

1. Non-recoverability. The NVD description states the node "does not recover automatically on all deployments and may require manual intervention to restore service." A crash that halts a node permanently until restart converts a soft DoS into an operational outage.
2. Low privilege. Only read access to a single index is required. Multi-tenant clusters, shared search platforms, and any deployment exposing query APIs to semi-trusted users are exposed.

No function names, class names, or internal call paths are provided in the available intelligence; the vulnerable code path should be treated as the scripted geometry builder/serializer in the runtime-field subsystem. Version ranges are unspecified — no affected-version list, OSV package mapping, or vendor advisory was published in the data supplied. Note that CWE-674 can also manifest as uncontrolled memory consumption, but the description explicitly attributes this instance to stack space exhaustion.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template exists for this CVE. The attack chain below is inferred from the vulnerability class and the NVD description; it does not assert undocumented implementation details.

1. Reconnaissance / target identification. The attacker locates a reachable Elasticsearch cluster. The query API (default TCP 9200) must be network-reachable, and the attacker must hold valid credentials with read permission on at least one index. Discovery is typically performed via Shodan/Censys searches for exposed Elasticsearch endpoints or by fingerprinting in an authenticated context.

2. Trigger condition. The attacker submits a search request that defines a runtime field implemented as a script (per the description, a "scripted runtime field"). The script's output is a geometry value built as a deeply nested structure — for example, nested coordinate arrays produced programmatically rather than as a literal string. Because the script-generated path omits the nesting-depth limit applied to text geometry, the attacker controls the depth directly through script logic.

3. Execution method. Delivery is a single authenticated search request. The attacker iteratively increases the nesting depth of the generated structure until serialization recurses past the available stack space on the node handling the request. There is no injection primitive required; the script engine is a legitimate feature being used within its permitted authorization scope.

4. Post-exploitation impact. The node handling the request terminates. Depending on deployment topology and recovery behavior, the node may not self-restore, requiring operator intervention (manual restart or service restoration). Repeated requests across nodes or sustained attempts convert a single crash into cluster-wide unavailability. Availability impact is High (A:H); confidentiality and integrity are unaffected (C:N/I:N/A:H).

Impact Assessment

CVSS 3.1 base score 6.5 (Medium) reflecting AV:N, AC:L, PR:L, UI:N, S:U, C:N, I:N, A:H.

• Availability: Primary impact. Node termination, non-automatic recovery on some deployments, and potential cluster-wide DoS if exploitation is repeated.
• Blast radius: Any Elasticsearch deployment where an authenticated principal holds read access to an index and can submit runtime-field search requests. Shared/multi-tenant clusters and customer-facing search platforms carry the widest exposure because low-privilege tenants can affect shared nodes.
• Business impact: Search outage, dashboards and observability pipelines failing, and manual remediation cost. If Elasticsearch backs SIEM, logging, or application search, secondary availability loss extends to dependent systems.
• Confidentiality/Integrity: None per vector.
• Exploitability context: EPSS not yet scored; not in CISA KEV; no public exploit. The barrier to entry is low (authenticated read access only), but no weaponized artifact is publicly available.

Detection Guidance

Sigma Rule

title: Elasticsearch Uncontrolled Recursion via Scripted Runtime Field
id: 4f1e9b2c-3d5a-4c7e-9a10-8b6c2d7f5a01
status: experimental
description: Detects search requests defining scripted runtime fields that may trigger
  uncontrolled recursion (CWE-674) in geometry construction/serialization.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103008
author: valtersit.com
logsource:
  product: elasticsearch
  category: application
detection:
  selection:
    event.action|contains:
      - 'search'
    http.request.body|contains:
      - '"runtime_mappings"'
  filter_script:
    http.request.body|contains:
      - '"script"'
  condition: selection and filter_script
level: medium
falsepositives:
  - Legitimate use of scripted runtime fields without deep nesting

YARA Rule

rule CVE_2026_103008_Elasticsearch_Scripted_Geometry_Recursion
{
    meta:
        description = "Detects request payloads abusing scripted runtime fields producing deeply nested geometry values in Elasticsearch (CWE-674)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-103008"
        author = "valtersit.com"
        date = "2026-01-01"
        cve = "CVE-2026-103008"
    strings:
        $r1 = "runtime_mappings"
        $r2 = "\"script\""
        $s1 = "source" nocase
        $geom1 = "geometry" nocase
        $geom2 = "geo_shape" nocase
        $arr = "[[[["
    condition:
        uint16(0) != 0x0000 and
        (($r1 and $r2) or ($geom1 or $geom2) or $s1) and $arr
}

Suricata IDS Rule

alert http any any -> any 9200 (msg:"CVE-2026-103008 Elasticsearch Scripted Runtime Field Uncontrolled Recursion Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"_search"; http.request_body; content:"runtime_mappings"; http.request_body; content:"script"; http.request_body; content:"[[[[["; classtype:attempted-dos; reference:cve,2026-103008; sid:1000308; rev:1;)

Elastic Detection

sequence by host.id, user.name with maxspan=1m
  [ any where event.category == "web" and url.path contains "_search" and
      http.request.body.content contains "runtime_mappings" and
      http.request.body.content contains "script" ]
  [ any where event.category == "process" and event.action == "process_exited" and
      process.name in ("java", "elasticsearch") ]

Splunk SPL Query

index=elasticsearch sourcetype=elasticsearch:json
| search ("runtime_mappings" AND "script" AND "geometry")
| eval nesting_score = len(replace(_raw, "[^[]", ""))
| where nesting_score > 20
| stats count min(_time) as first_seen max(_time) as last_seen by clientip, uri_path, user
| where count > 1
| sort - count

Wazuh OSSEC Rule

<group name="elasticsearch,attack,">
  <rule id="100308" level="10">
    <decoded_as>json</decoded_as>
    <field name="request.body">runtime_mappings</field>
    <description>CVE-2026-103008: Possible Elasticsearch uncontrolled recursion via scripted runtime field.</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source; no vendor fix or affected-version list has been published.

1. Immediate mitigations

   • Restrict read access so that only trusted principals can query indices; the vulnerability requires only read access to a single index.
   • Review and constrain runtime-field usage: prevent untrusted scripted runtime-field definitions via restricted roles if the platform permits.
   • Monitor node termination events and configure supervised service restart (systemd Restart=always or container restart policies) to reduce manual-recovery burden.
   • Segment and firewall the Elasticsearch transport/HTTP ports so that only authorized clients can reach the query API.

2. Patch/upgrade steps

   • No patch is currently available. Track the vendor's security advisory channel for Elasticsearch release notes and apply the fixed version as soon as it is published.
   • Treat any announced patch as requiring both a cluster restart and validation of scripted runtime-field behavior after upgrade.

3. Long-term hardening

   • Enforce least privilege: avoid granting broad read access, particularly in multi-tenant clusters.
   • Apply resource limits at the query layer (search timeouts, circuit breakers) where supported.
   • Maintain Wazuh/Elastic detection rules above to alert on high-nesting scripted runtime-field requests.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-103008
• CWE-674 Uncontrolled Recursion: https://cwe.mitre.org/data/definitions/674.html
• Elastic Security Advisories: https://www.elastic.co/community/security
• FIRST EPSS: not yet scored (https://www.first.org/epss/)
• CISA KEV: not listed (https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

No threat-actor campaign or exploit-in-the-wild evidence is associated with this CVE in the available data.