Elasticsearch ML component deserialization flaw enables RCE via crafted model artifact
Deserialization of untrusted data (CWE-502) in Elasticsearch's ML component lets a privileged user achieve RCE by submitting a crafted model artifact. Patched in 8.19.20, 9.4.5, and 9.5.1.
- Vendor
- Elastic
- Product
- Elasticsearch
- CVSS
- 8.8
- EPSS (exploit probability)
- 0.6%
- Status
- patched
- Published
Elastic’s advisory ESA-2026-114 documents a deserialization of untrusted data flaw (CWE-502) in the machine learning component of Elasticsearch. A user with elevated cluster privileges can submit a specially crafted trained model artifact; processing that artifact triggers object injection (CAPEC-586) and achieves code execution on the Elasticsearch node.
Affected versions
Versions before the patched releases in each maintained branch are vulnerable:
- 8.x before 8.19.20
- 9.4.x before 9.4.5
- 9.5.x before 9.5.1
Mitigation
Update to 8.19.20, 9.4.5, or 9.5.1, available via Elastic’s standard release channel. ML upload privilege scoping should also be reviewed, particularly in deployments that process model artifacts sourced from outside a controlled internal pipeline.
