CVE-2026-115710

The record

Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and incorrect search results via specially crafted search requests. For some query types, Elasticsearch can share cached query results between users who have field-level security restrictions and users who do not. A user restricted by field-level security can learn which documents match a value in a field that they cannot read. A restricted user can also cause users with full access to receive incomplete search results. Disclosure is only possible when a user with full access ran the same query on the same shard recently.

Affected packages

Related vulnerabilities

• CVE-2026-113593 An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before… CWE-524
• CVE-2026-118489 In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient`… CWE-524
• CVE-2026-111464 The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure… CWE-524
• CVE-2026-109217 The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to… CWE-524
• CVE-2026-105711 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.0 before… CWE-524
• CVE-2026-108088 ** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information… CWE-524
• CVE-2026-85317 Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP… CWE-524
• CVE-2026-109829 undici is an HTTP client library for Node.js. CWE-524