Elastic Elasticsearch vulnerabilities

CVE-2015-1427 [CRITICAL] CVE-2015-1427: The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attac The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

CVE-2014-3120 [HIGH] CWE-284 CVE-2014-3120: The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.

CVE-2015-5531 [MEDIUM] CVE-2015-5531: Directory traversal vulnerability in Elasticsearch before 1 Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.

CVE-2023-31419 [HIGH] CWE-121 CVE-2023-31419: A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted q A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.

CVE-2021-22145 [MEDIUM] CWE-200 CVE-2021-22145: A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing previously used portions of a data buffer. This buffer could contain sensitive information suc

CVE-2021-22146 [HIGH] CVE-2021-22146: All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default i All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters. While in the default setting the anonymous user has no permissions and is unable to successfully query any Elasticsearch APIs, an attacker could leverage the anonymous user to gain insight into certain details of a deployed cluster.

CVE-2023-31418 [HIGH] CWE-400 CVE-2023-31418: An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests. The issue was identified by Elastic Engineering and we have no indication that the issue is known or that it

CVE-2026-72649 [HIGH] CWE-502 CVE-2026-72649: Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface than intended. Exploitation requires an authenticated u

CVE-2015-5377 [CRITICAL] CVE-2015-5377: Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol. NOTE: ZDI appears to claim that CVE-2015-3253 and CVE-2015-5377 are the same vulnerability

CVE-2026-72642 [HIGH] CWE-823 CVE-2026-72642: The native inference process that Elasticsearch uses to evaluate uploaded machine learning models ac The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storage. A user with the privileges required to upload and deploy a trained mod

CVE-2020-7014 [HIGH] CVE-2020-7014: The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and also authentication tokens. An attacker who is able to generate an API key and an authentication token can perform a series of steps that result in an authentication

CVE-2021-37937 [HIGH] CWE-269 CVE-2021-37937: An issue was found with how API keys are created with the Fleet-Server service account. When an API An issue was found with how API keys are created with the Fleet-Server service account. When an API key is created with a service account, it is possible that the API key could be created with higher privileges than intended. Using this vulnerability, a compromised Fleet-Server service account could escalate themselves to a super-user.

CVE-2020-7009 [HIGH] CWE-266 CVE-2020-7009: Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.

CVE-2015-4165 [HIGH] CVE-2015-4165: The snapshot API in Elasticsearch before 1 The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files and execute code from them, is accessible by the attacker, and the Java VM on which Elasticsearch is running can write to a location that the other application can read and execute from, allows remote authenticated users to write to and create arbitrary snapshot metadata files, and potentially execut

CVE-2018-3831 [HIGH] CWE-200 CVE-2018-3831: Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclos Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elasticsearch _cluster/settings API, when queried, could leak sensitive configuration information such as passwords, tokens, or usernames. This could allow an authenticated Elasticsearch user to impro

CVE-2022-23712 [HIGH] CWE-754 CVE-2022-23712: A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability, an unauthenticat A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability, an unauthenticated attacker could forcibly shut down an Elasticsearch node with a specifically formatted network request.

CVE-2026-103007 [HIGH] CWE-863 CVE-2026-103007: Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator delegate limited role-management capa

CVE-2019-7611 [HIGH] CWE-284 CVE-2019-7611: A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Secu A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the _aliases, _shrink, or _split endpoints are used . If the elasticsearch.yml file has xpack.security.dls_fls.enabled set to false, certain permission checks are skipped when users perform one of the acti

CVE-2025-37731 [HIGH] CWE-287 CVE-2025-37731: Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially craf Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.

CVE-2026-78607 [HIGH] CWE-862 CVE-2026-78607: Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to informatio Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause administrator-provisioned credentials to be exposed