{"schema":"vulnpedia.research/1","cve":"CVE-2026-103007","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-197/390871","tags":["Vendor Advisory","vendor-reference"],"source":"mitre","sourceId":"elastic","modified":"2026-10-06T19:31:50.520Z","origins":[{"source":"mitre","sourceId":"elastic","modified":"2026-10-06T19:31:50.520Z","url":"https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-197/390871"},{"source":"nvd","sourceId":"CVE-2026-103007","modified":"2026-10-09T13:25:39.420","url":"https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-197/390871"},{"source":"redhat","sourceId":"CVE-2026-103007","modified":"2026-10-21T20:53:12+00:00","url":"https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-7-9-5-4-security-update-esa-2026-197/390871"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103007.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-103007","modified":"2026-10-21T20:53:12+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-103007","modified":"2026-10-21T20:53:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103007.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-103007","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-103007","modified":"2026-10-21T20:53:12+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-103007","modified":"2026-10-21T20:53:12+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-103007"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547103","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-103007","modified":"2026-10-21T20:53:12+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-103007","modified":"2026-10-21T20:53:12+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547103"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-103007","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-103007","modified":"2026-10-21T20:53:12+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-103007","modified":"2026-10-21T20:53:12+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-103007"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103007","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-103007","modified":"2026-10-21T20:53:12+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-103007","modified":"2026-10-21T20:53:12+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103007"}]},{"source":"euvd","sourceId":"EUVD-2026-93937","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-93937","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-93937","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-93937"}]}],"packages":[],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-103007","modified":"2026-10-21T20:53:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103007.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-feature-server-rhel9","product":"rhoai/odh-feature-server-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"For deployments that use the delegated role-management privilege, review all roles that grant it and ensure their configured index names do not use wildcard or regular-expression patterns that could match system or restricted indices; restrict such grants to literal index names, or remove the privilege from roles assigned to users who should not be able to expand their own access. Audit existing roles created through this feature for unexpected access to restricted or internal indices, and review security audit logs for role or user modifications performed by accounts holding this privilege. Upstream has fixed the issue in Elasticsearch 8.19.22, 9.4.7, and 9.5.4, and upgrading to one of these or a later release verified to contain the fix is recommended. For the affected Fedora and EPEL community packages, apply updated packages once the community provides builds containing the upstream fix."},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/odh-feature-server-rhel9?repository_url=registry.redhat.io/rhoai/odh-feature-server-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-103007","modified":"2026-10-21T20:53:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103007.json"}]},{"source":"redhat","sourceId":"CVE-2026-103007","modified":"2026-10-21T20:53:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103007.json","productId":"red_hat_quay_3:quay/quay-rhel8","product":"quay/quay-rhel8 as a component of Red Hat Quay 3","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/quay-rhel8?repository_url=registry.redhat.io/quay/quay-rhel8","origins":[{"source":"redhat","sourceId":"CVE-2026-103007","modified":"2026-10-21T20:53:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103007.json"}]},{"source":"redhat","sourceId":"CVE-2026-103007","modified":"2026-10-21T20:53:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103007.json","productId":"red_hat_quay_3:quay/quay-rhel9","product":"quay/quay-rhel9 as a component of Red Hat Quay 3","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/quay-rhel9?repository_url=registry.redhat.io/quay/quay-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-103007","modified":"2026-10-21T20:53:12+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-103007.json"}]}],"vendorCoverage":{"total":3,"shown":3,"omitted":0,"source":"redhat"}}