[Transform] Fix transform validation to reject PUT and _start when user lacks remote index permissions by valeriy42 · Pull Request #142403 · elastic/elasticsearch

valeriy42 · 2026-02-12T15:35:00Z

When a transform is configured with a remote (cross-cluster) source index and the user lacks permissions to access it, the _preview API correctly fails -- but PUT _transform and _start silently succeed, allowing unauthorized transforms to be created and started. The root cause is that validateQuery in AbstractCompositeAggFunction only checks the response status code, which is OK even when IndicesOptions.LENIENT_EXPAND_OPEN causes unauthorized indices to be silently ignored. The search returns null aggregations in this case, but unlike preview(), validateQuery() never checks for that condition.

This PR introduces a SourceAccessDiagnostics class that inspects the SearchResponse for security-related failures at both the CCS cluster level (SKIPPED/FAILED clusters with ElasticsearchSecurityException) and the shard level (FORBIDDEN/UNAUTHORIZED status). A null-aggregation check is added to validateQuery(), but -- critically -- it only rejects the request when a security failure is positively identified. When no security failure is found, validation passes through silently. This distinction avoids the regression that caused PR #95318 to be reverted in #95562: that earlier change unconditionally failed on null aggregations, which broke integrations (such as Elastic Defend) that create and start transforms with wildcard source patterns before any matching indices exist. Since defer_validation only defers from PUT to _start, there was no way for those integrations to bypass the check. Our approach preserves backward compatibility for the empty-indices case while catching the unauthorized-remote-index case. The preview() method also delegates to the same diagnostics class, so all three APIs now produce consistent, actionable error messages when a security failure is detected, falling back to the original generic message otherwise.

The multi-cluster YAML integration tests are updated to verify that both PUT _transform and _start now reject unauthorized remote transforms. A new test case creates a transform with defer_validation: true and confirms that _start catches the permission issue. Unit tests for SourceAccessDiagnostics cover cluster-level SKIPPED/FAILED scenarios, shard-level security exceptions, FORBIDDEN/UNAUTHORIZED status codes, and the fallback to the generic message for non-security failures.

Fixes #95367

elasticsearchmachine · 2026-02-12T15:35:43Z

Pinging @elastic/ml-core (Team:ML)

Copilot

Pull request overview

Fixes transform source validation so that unauthorized cross-cluster (remote) source indices cause PUT _transform and _start to fail consistently (matching _preview), with clearer diagnostics.

Changes:

Add SourceAccessDiagnostics to detect security-related CCS/shard failures and return actionable error messages.
Update preview() and validateQuery() to use diagnostics when aggregations are null.
Expand multi-cluster security YAML tests and add unit tests for the new diagnostics behavior.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/transforms/common/SourceAccessDiagnostics.java	Adds centralized diagnostics for permission vs missing-index cases when aggregations are null.
x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/transforms/common/AbstractCompositeAggFunction.java	Uses diagnostics in `preview()` and adds null-aggregation validation in `validateQuery()`.
x-pack/plugin/transform/src/test/java/org/elasticsearch/xpack/transform/transforms/common/SourceAccessDiagnosticsTests.java	Adds unit coverage for cluster/shard security failures and fallback behavior.
x-pack/plugin/transform/qa/multi-cluster-tests-with-security/src/test/resources/rest-api-spec/test/multi_cluster/80_transform.yml	Updates/extends integration tests to assert `PUT` and `_start` reject unauthorized remote sources.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

...c/main/java/org/elasticsearch/xpack/transform/transforms/common/SourceAccessDiagnostics.java

...t/java/org/elasticsearch/xpack/transform/transforms/common/SourceAccessDiagnosticsTests.java

valeriy42 · 2026-02-12T15:56:18Z

Here's the PR comment text:

Historical context: PR #95318 and its revert #95562

While investigating this fix, I discovered that the same null-aggregation check in validateQuery() was previously attempted in PR #95318 (April 2023) and reverted five days later in #95562. The revert message gives no explanation, but a Slack thread between the transform team and the Elastic Defend/Fleet teams documents the full story.

What happened:

PR #95318 added an unconditional aggregations == null check to validateQuery(), causing it to fail with "Source indices have been deleted or closed." This broke the Elastic Defend integration (Kibana issue #155709), which installs transforms via Fleet with source patterns like metrics-endpoint.metadata-*. The transforms are created with defer_validation=true and started immediately, but at that point no data has been ingested yet -- the wildcard resolves to zero indices.

The key insight is that defer_validation only moves validation from PUT to _start. There is no mechanism to defer past _start. So the new check simply moved the failure from PUT to _start, breaking all integrations that start transforms before source data exists. Hendrik Muhs recommended reverting on the release branch and investigating on main, noting that the improvement might need to be saved for a major release if it cannot be made backward-compatible.

How this PR avoids the same regression:

Instead of unconditionally failing on null aggregations, validateQuery() now calls SourceAccessDiagnostics.diagnoseSourceAccessFailure(response) and only rejects the request when a security failure is positively identified (e.g., ElasticsearchSecurityException in CCS cluster-level or shard-level failures). When no security failure is found, the diagnostics returns the generic fallback message, and validation passes through silently -- preserving the existing lenient behavior for the empty-indices case.

Open question:

Whether this approach catches all unauthorized-remote-index scenarios depends on how IndicesOptions.LENIENT_EXPAND_OPEN interacts with CCS authorization failures. If the lenient options suppress security exceptions from appearing in the SearchResponse metadata entirely (no cluster-level SKIPPED/FAILED status, no shard failures), then diagnoseSourceAccessFailure() would return the fallback message and validation would still pass through. The multi-cluster integration tests will confirm this. If it turns out that security failures are not surfaced in the response, we may need an alternative detection strategy (e.g., checking whether source indices include remote patterns and applying stricter validation only for that path).

cc @elastic/fleet

elasticsearchmachine · 2026-02-12T15:57:17Z

Hi @valeriy42, I've created a changelog YAML for you.

…arch into bug/is-95367

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-12T16:07:49Z

...c/main/java/org/elasticsearch/xpack/transform/transforms/common/SourceAccessDiagnostics.java

+            for (ShardSearchFailure failure : cluster.getFailures()) {
+                if (isSecurityFailure(failure)) {
+                    return "User lacks the required permissions to read source indices on cluster [" + alias + "].";
+                }
+            }


cluster.getFailures() can be null for clusters without recorded failures, which would throw an NPE during iteration. Add a null/empty check before iterating (or iterate over an empty list when failures is null) to make this safe for all SearchResponse.Cluster instances.

Copilot · 2026-02-12T16:07:49Z

...n/java/org/elasticsearch/xpack/transform/transforms/common/AbstractCompositeAggFunction.java

+                if (response.getAggregations() == null) {
+                    String diagnosis = SourceAccessDiagnostics.diagnoseSourceAccessFailure(response);
+                    if (diagnosis.equals(SourceAccessDiagnostics.SOURCE_INDICES_MISSING) == false) {
+                        listener.onFailure(new ValidationException().addValidationError(diagnosis));
+                        return;
+                    }
+                }


Control flow is determined by comparing the returned message string to SOURCE_INDICES_MISSING, which is brittle (message wording becomes part of the API contract). Consider changing SourceAccessDiagnostics to return a structured result (e.g., Optional<String> for a detected security message, or an enum + message), so validateQuery() can branch on an explicit signal rather than string equality.

...c/main/java/org/elasticsearch/xpack/transform/transforms/common/SourceAccessDiagnostics.java

docs/changelog/142403.yaml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

...ter-tests-with-security/src/test/resources/rest-api-spec/test/multi_cluster/80_transform.yml

docs/changelog/142403.yaml

Co-authored-by: Pat Whelan <pat.whelan@elastic.co>

elasticsearchmachine · 2026-02-12T21:36:27Z

💔 Backport failed

Status	Branch	Result
✅	9.3
❌	8.19	Commit could not be cherrypicked due to conflicts
❌	9.2	Commit could not be cherrypicked due to conflicts

You can use sqren/backport to manually backport by running backport --upstream elastic/elasticsearch --pr 142403

…er lacks remote index permissions (elastic#142403) When a transform is configured with a remote (cross-cluster) source index and the user lacks permissions to access it, the _preview API correctly fails -- but PUT _transform and _start silently succeed, allowing unauthorized transforms to be created and started. The root cause is that validateQuery in AbstractCompositeAggFunction only checks the response status code, which is OK even when IndicesOptions.LENIENT_EXPAND_OPEN causes unauthorized indices to be silently ignored. The search returns null aggregations in this case, but unlike preview(), validateQuery() never checks for that condition. This PR introduces a SourceAccessDiagnostics class that inspects the SearchResponse for security-related failures at both the CCS cluster level (SKIPPED/FAILED clusters with ElasticsearchSecurityException) and the shard level (FORBIDDEN/UNAUTHORIZED status). A null-aggregation check is added to validateQuery(), but -- critically -- it only rejects the request when a security failure is positively identified. When no security failure is found, validation passes through silently. This distinction avoids the regression that caused PR elastic#95318 to be reverted in elastic#95562: that earlier change unconditionally failed on null aggregations, which broke integrations (such as Elastic Defend) that create and start transforms with wildcard source patterns before any matching indices exist. Since defer_validation only defers from PUT to _start, there was no way for those integrations to bypass the check. Our approach preserves backward compatibility for the empty-indices case while catching the unauthorized-remote-index case. The preview() method also delegates to the same diagnostics class, so all three APIs now produce consistent, actionable error messages when a security failure is detected, falling back to the original generic message otherwise. The multi-cluster YAML integration tests are updated to verify that both PUT _transform and _start now reject unauthorized remote transforms. A new test case creates a transform with defer_validation: true and confirms that _start catches the permission issue. Unit tests for SourceAccessDiagnostics cover cluster-level SKIPPED/FAILED scenarios, shard-level security exceptions, FORBIDDEN/UNAUTHORIZED status codes, and the fallback to the generic message for non-security failures. Fixes elastic#95367

…er lacks remote index permissions (elastic#142403) When a transform is configured with a remote (cross-cluster) source index and the user lacks permissions to access it, the _preview API correctly fails -- but PUT _transform and _start silently succeed, allowing unauthorized transforms to be created and started. The root cause is that validateQuery in AbstractCompositeAggFunction only checks the response status code, which is OK even when IndicesOptions.LENIENT_EXPAND_OPEN causes unauthorized indices to be silently ignored. The search returns null aggregations in this case, but unlike preview(), validateQuery() never checks for that condition. This PR introduces a SourceAccessDiagnostics class that inspects the SearchResponse for security-related failures at both the CCS cluster level (SKIPPED/FAILED clusters with ElasticsearchSecurityException) and the shard level (FORBIDDEN/UNAUTHORIZED status). A null-aggregation check is added to validateQuery(), but -- critically -- it only rejects the request when a security failure is positively identified. When no security failure is found, validation passes through silently. This distinction avoids the regression that caused PR elastic#95318 to be reverted in elastic#95562: that earlier change unconditionally failed on null aggregations, which broke integrations (such as Elastic Defend) that create and start transforms with wildcard source patterns before any matching indices exist. Since defer_validation only defers from PUT to _start, there was no way for those integrations to bypass the check. Our approach preserves backward compatibility for the empty-indices case while catching the unauthorized-remote-index case. The preview() method also delegates to the same diagnostics class, so all three APIs now produce consistent, actionable error messages when a security failure is detected, falling back to the original generic message otherwise. The multi-cluster YAML integration tests are updated to verify that both PUT _transform and _start now reject unauthorized remote transforms. A new test case creates a transform with defer_validation: true and confirms that _start catches the permission issue. Unit tests for SourceAccessDiagnostics cover cluster-level SKIPPED/FAILED scenarios, shard-level security exceptions, FORBIDDEN/UNAUTHORIZED status codes, and the fallback to the generic message for non-security failures. Fixes elastic#95367 (cherry picked from commit 0e44984) # Conflicts: # x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/transforms/common/AbstractCompositeAggFunction.java

valeriy42 · 2026-02-13T09:10:56Z

💚 All backports created successfully

Status	Branch	Result
✅	9.2
✅	8.19

Questions ?

Please refer to the Backport tool documentation

…er lacks remote index permissions (elastic#142403) When a transform is configured with a remote (cross-cluster) source index and the user lacks permissions to access it, the _preview API correctly fails -- but PUT _transform and _start silently succeed, allowing unauthorized transforms to be created and started. The root cause is that validateQuery in AbstractCompositeAggFunction only checks the response status code, which is OK even when IndicesOptions.LENIENT_EXPAND_OPEN causes unauthorized indices to be silently ignored. The search returns null aggregations in this case, but unlike preview(), validateQuery() never checks for that condition. This PR introduces a SourceAccessDiagnostics class that inspects the SearchResponse for security-related failures at both the CCS cluster level (SKIPPED/FAILED clusters with ElasticsearchSecurityException) and the shard level (FORBIDDEN/UNAUTHORIZED status). A null-aggregation check is added to validateQuery(), but -- critically -- it only rejects the request when a security failure is positively identified. When no security failure is found, validation passes through silently. This distinction avoids the regression that caused PR elastic#95318 to be reverted in elastic#95562: that earlier change unconditionally failed on null aggregations, which broke integrations (such as Elastic Defend) that create and start transforms with wildcard source patterns before any matching indices exist. Since defer_validation only defers from PUT to _start, there was no way for those integrations to bypass the check. Our approach preserves backward compatibility for the empty-indices case while catching the unauthorized-remote-index case. The preview() method also delegates to the same diagnostics class, so all three APIs now produce consistent, actionable error messages when a security failure is detected, falling back to the original generic message otherwise. The multi-cluster YAML integration tests are updated to verify that both PUT _transform and _start now reject unauthorized remote transforms. A new test case creates a transform with defer_validation: true and confirms that _start catches the permission issue. Unit tests for SourceAccessDiagnostics cover cluster-level SKIPPED/FAILED scenarios, shard-level security exceptions, FORBIDDEN/UNAUTHORIZED status codes, and the fallback to the generic message for non-security failures. Fixes elastic#95367 (cherry picked from commit 0e44984) # Conflicts: # x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/transforms/common/AbstractCompositeAggFunction.java

…hen user lacks remote index permissions (#142403) (#142454) * [Transform] Fix transform validation to reject PUT and _start when user lacks remote index permissions (#142403) When a transform is configured with a remote (cross-cluster) source index and the user lacks permissions to access it, the _preview API correctly fails -- but PUT _transform and _start silently succeed, allowing unauthorized transforms to be created and started. The root cause is that validateQuery in AbstractCompositeAggFunction only checks the response status code, which is OK even when IndicesOptions.LENIENT_EXPAND_OPEN causes unauthorized indices to be silently ignored. The search returns null aggregations in this case, but unlike preview(), validateQuery() never checks for that condition. This PR introduces a SourceAccessDiagnostics class that inspects the SearchResponse for security-related failures at both the CCS cluster level (SKIPPED/FAILED clusters with ElasticsearchSecurityException) and the shard level (FORBIDDEN/UNAUTHORIZED status). A null-aggregation check is added to validateQuery(), but -- critically -- it only rejects the request when a security failure is positively identified. When no security failure is found, validation passes through silently. This distinction avoids the regression that caused PR #95318 to be reverted in #95562: that earlier change unconditionally failed on null aggregations, which broke integrations (such as Elastic Defend) that create and start transforms with wildcard source patterns before any matching indices exist. Since defer_validation only defers from PUT to _start, there was no way for those integrations to bypass the check. Our approach preserves backward compatibility for the empty-indices case while catching the unauthorized-remote-index case. The preview() method also delegates to the same diagnostics class, so all three APIs now produce consistent, actionable error messages when a security failure is detected, falling back to the original generic message otherwise. The multi-cluster YAML integration tests are updated to verify that both PUT _transform and _start now reject unauthorized remote transforms. A new test case creates a transform with defer_validation: true and confirms that _start catches the permission issue. Unit tests for SourceAccessDiagnostics cover cluster-level SKIPPED/FAILED scenarios, shard-level security exceptions, FORBIDDEN/UNAUTHORIZED status codes, and the fallback to the generic message for non-security failures. Fixes #95367 (cherry picked from commit 0e44984) # Conflicts: # x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/transforms/common/AbstractCompositeAggFunction.java * Fix SearchResponse.Cluster constructor arity in SourceAccessDiagnosticsTests * checkstyle

…hen user lacks remote index permissions (#142403) (#142430) * [Transform] Fix transform validation to reject PUT and _start when user lacks remote index permissions (#142403) When a transform is configured with a remote (cross-cluster) source index and the user lacks permissions to access it, the _preview API correctly fails -- but PUT _transform and _start silently succeed, allowing unauthorized transforms to be created and started. The root cause is that validateQuery in AbstractCompositeAggFunction only checks the response status code, which is OK even when IndicesOptions.LENIENT_EXPAND_OPEN causes unauthorized indices to be silently ignored. The search returns null aggregations in this case, but unlike preview(), validateQuery() never checks for that condition. This PR introduces a SourceAccessDiagnostics class that inspects the SearchResponse for security-related failures at both the CCS cluster level (SKIPPED/FAILED clusters with ElasticsearchSecurityException) and the shard level (FORBIDDEN/UNAUTHORIZED status). A null-aggregation check is added to validateQuery(), but -- critically -- it only rejects the request when a security failure is positively identified. When no security failure is found, validation passes through silently. This distinction avoids the regression that caused PR #95318 to be reverted in #95562: that earlier change unconditionally failed on null aggregations, which broke integrations (such as Elastic Defend) that create and start transforms with wildcard source patterns before any matching indices exist. Since defer_validation only defers from PUT to _start, there was no way for those integrations to bypass the check. Our approach preserves backward compatibility for the empty-indices case while catching the unauthorized-remote-index case. The preview() method also delegates to the same diagnostics class, so all three APIs now produce consistent, actionable error messages when a security failure is detected, falling back to the original generic message otherwise. The multi-cluster YAML integration tests are updated to verify that both PUT _transform and _start now reject unauthorized remote transforms. A new test case creates a transform with defer_validation: true and confirms that _start catches the permission issue. Unit tests for SourceAccessDiagnostics cover cluster-level SKIPPED/FAILED scenarios, shard-level security exceptions, FORBIDDEN/UNAUTHORIZED status codes, and the fallback to the generic message for non-security failures. Fixes #95367 * Fix SearchResponse.Cluster constructor arity in SourceAccessDiagnosticsTests * checkstyle

…er lacks remote index permissions (elastic#142403) When a transform is configured with a remote (cross-cluster) source index and the user lacks permissions to access it, the _preview API correctly fails -- but PUT _transform and _start silently succeed, allowing unauthorized transforms to be created and started. The root cause is that validateQuery in AbstractCompositeAggFunction only checks the response status code, which is OK even when IndicesOptions.LENIENT_EXPAND_OPEN causes unauthorized indices to be silently ignored. The search returns null aggregations in this case, but unlike preview(), validateQuery() never checks for that condition. This PR introduces a SourceAccessDiagnostics class that inspects the SearchResponse for security-related failures at both the CCS cluster level (SKIPPED/FAILED clusters with ElasticsearchSecurityException) and the shard level (FORBIDDEN/UNAUTHORIZED status). A null-aggregation check is added to validateQuery(), but -- critically -- it only rejects the request when a security failure is positively identified. When no security failure is found, validation passes through silently. This distinction avoids the regression that caused PR elastic#95318 to be reverted in elastic#95562: that earlier change unconditionally failed on null aggregations, which broke integrations (such as Elastic Defend) that create and start transforms with wildcard source patterns before any matching indices exist. Since defer_validation only defers from PUT to _start, there was no way for those integrations to bypass the check. Our approach preserves backward compatibility for the empty-indices case while catching the unauthorized-remote-index case. The preview() method also delegates to the same diagnostics class, so all three APIs now produce consistent, actionable error messages when a security failure is detected, falling back to the original generic message otherwise. The multi-cluster YAML integration tests are updated to verify that both PUT _transform and _start now reject unauthorized remote transforms. A new test case creates a transform with defer_validation: true and confirms that _start catches the permission issue. Unit tests for SourceAccessDiagnostics cover cluster-level SKIPPED/FAILED scenarios, shard-level security exceptions, FORBIDDEN/UNAUTHORIZED status codes, and the fallback to the generic message for non-security failures. Fixes elastic#95367

…when user lacks remote index permissions (#142403) (#142455) * [Transform] Fix transform validation to reject PUT and _start when user lacks remote index permissions (#142403) When a transform is configured with a remote (cross-cluster) source index and the user lacks permissions to access it, the _preview API correctly fails -- but PUT _transform and _start silently succeed, allowing unauthorized transforms to be created and started. The root cause is that validateQuery in AbstractCompositeAggFunction only checks the response status code, which is OK even when IndicesOptions.LENIENT_EXPAND_OPEN causes unauthorized indices to be silently ignored. The search returns null aggregations in this case, but unlike preview(), validateQuery() never checks for that condition. This PR introduces a SourceAccessDiagnostics class that inspects the SearchResponse for security-related failures at both the CCS cluster level (SKIPPED/FAILED clusters with ElasticsearchSecurityException) and the shard level (FORBIDDEN/UNAUTHORIZED status). A null-aggregation check is added to validateQuery(), but -- critically -- it only rejects the request when a security failure is positively identified. When no security failure is found, validation passes through silently. This distinction avoids the regression that caused PR #95318 to be reverted in #95562: that earlier change unconditionally failed on null aggregations, which broke integrations (such as Elastic Defend) that create and start transforms with wildcard source patterns before any matching indices exist. Since defer_validation only defers from PUT to _start, there was no way for those integrations to bypass the check. Our approach preserves backward compatibility for the empty-indices case while catching the unauthorized-remote-index case. The preview() method also delegates to the same diagnostics class, so all three APIs now produce consistent, actionable error messages when a security failure is detected, falling back to the original generic message otherwise. The multi-cluster YAML integration tests are updated to verify that both PUT _transform and _start now reject unauthorized remote transforms. A new test case creates a transform with defer_validation: true and confirms that _start catches the permission issue. Unit tests for SourceAccessDiagnostics cover cluster-level SKIPPED/FAILED scenarios, shard-level security exceptions, FORBIDDEN/UNAUTHORIZED status codes, and the fallback to the generic message for non-security failures. Fixes #95367 (cherry picked from commit 0e44984) # Conflicts: # x-pack/plugin/transform/src/main/java/org/elasticsearch/xpack/transform/transforms/common/AbstractCompositeAggFunction.java * fix compilation error * Add diagnostics for remote CCS clusters with zero shards Enhance the SourceAccessDiagnostics class to identify remote CCS clusters that return zero shards due to permission issues. This update includes a new method to check for such scenarios and updates the documentation accordingly. Additionally, new unit tests are added to verify the correct behavior when accessing remote clusters with insufficient permissions, ensuring that appropriate error messages are returned. This change improves the clarity of diagnostics related to security exceptions in cross-cluster searches. * fix unit test specifics for 8.19 * Update transform configuration in multi-cluster test to include defer_validation and modify description

initial commit

79c2ee5

valeriy42 requested a review from Copilot February 12, 2026 15:35

valeriy42 added >bug :ml Machine learning :ml/Transform Transform auto-backport Automatically create backport pull requests when merged v9.3.1 v9.4.0 v8.19.12 v9.2.6 labels Feb 12, 2026

valeriy42 changed the title ~~[ML] Fix transform validation to reject PUT and _start when user lacks remote index permissions~~ Feb 12, 2026

valeriy42 requested a review from prwhelan February 12, 2026 15:35

elasticsearchmachine added the Team:ML Meta label for the ML team label Feb 12, 2026

Copilot AI reviewed Feb 12, 2026

View reviewed changes

relax the test to fix the problem with Elastic Defend

402b2d8

valeriy42 added 3 commits February 12, 2026 16:57

Update docs/changelog/142403.yaml

68ce52a

Fix test gaps

e7e082d

Merge branch 'bug/is-95367' of https://github.com/valeriy42/elasticse…

510a84e

…arch into bug/is-95367

valeriy42 requested a review from Copilot February 12, 2026 16:06

valeriy42 and others added 2 commits February 12, 2026 17:06

Merge branch 'main' into bug/is-95367

f774635

Apply suggestion from @Copilot

1f0fc54

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Copilot AI reviewed Feb 12, 2026

View reviewed changes

Update docs/changelog/142403.yaml

cf8ff74

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

prwhelan removed the :ml Machine learning label Feb 12, 2026

prwhelan approved these changes Feb 12, 2026

View reviewed changes

...ter-tests-with-security/src/test/resources/rest-api-spec/test/multi_cluster/80_transform.yml Show resolved Hide resolved

docs/changelog/142403.yaml Outdated Show resolved Hide resolved

valeriy42 and others added 2 commits February 12, 2026 20:40

Update docs/changelog/142403.yaml

e4a6f49

Co-authored-by: Pat Whelan <pat.whelan@elastic.co>

Merge branch 'main' into bug/is-95367

76f8375

valeriy42 merged commit 0e44984 into elastic:main Feb 12, 2026
35 checks passed

valeriy42 mentioned this pull request Feb 12, 2026

[9.3] [Transform] Fix transform validation to reject PUT and _start when user lacks remote index permissions (#142403) #142430

Merged

elasticsearchmachine added the backport pending label Feb 12, 2026

This was referenced Feb 13, 2026

[Transform] Privilege checks don't work correctly for CCS #72715

Open

[9.2] [Transform] Fix transform validation to reject PUT and _start when user lacks remote index permissions (#142403) #142454

Merged

valeriy42 mentioned this pull request Feb 13, 2026

[8.19] [Transform] Fix transform validation to reject PUT and _start when user lacks remote index permissions (#142403) #142455

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Transform] Fix transform validation to reject PUT and _start when user lacks remote index permissions#142403

[Transform] Fix transform validation to reject PUT and _start when user lacks remote index permissions#142403
valeriy42 merged 10 commits intoelastic:mainfrom
valeriy42:bug/is-95367

valeriy42 commented Feb 12, 2026 •

edited

Loading

elasticsearchmachine commented Feb 12, 2026

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

valeriy42 commented Feb 12, 2026

elasticsearchmachine commented Feb 12, 2026

Copilot AI left a comment

Copilot AI Feb 12, 2026

Copilot AI Feb 12, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

elasticsearchmachine commented Feb 12, 2026

valeriy42 commented Feb 13, 2026

Labels

4 participants

Conversation

valeriy42 commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

elasticsearchmachine commented Feb 12, 2026

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

valeriy42 commented Feb 12, 2026

Historical context: PR #95318 and its revert #95562

elasticsearchmachine commented Feb 12, 2026

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

elasticsearchmachine commented Feb 12, 2026

💔 Backport failed

valeriy42 commented Feb 13, 2026

💚 All backports created successfully

Questions ?

Labels

4 participants

valeriy42 commented Feb 12, 2026 •

edited

Loading