Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Elasticsearch API Keys Can Be Used for Privilege Escalation

CVE-2020-7009 · published 6 years ago
Summary

Attackers who can create API keys in Elasticsearch can gain elevated access to the system. This can happen if Elasticsearch versions 6.7.0 to 6.8.7 or 7.0.0 to 7.6.1 are being used. To fix this, update to a non-vulnerable version of Elasticsearch.

What to do
  • Update elasticsearch org.elasticsearch:elasticsearch to version 6.8.8.
  • Update elasticsearch org.elasticsearch:elasticsearch to version 7.6.2.
Affected software
Ecosystem VendorProductAffected versions
maven elasticsearch org.elasticsearch:elasticsearch >= 6.7.0, <= 6.8.7
>= 7.0.0, <= 7.6.1
Fix: upgrade to 6.8.8
– elastic elasticsearch >= 6.7.0, < 6.8.8
>= 7.0.0, < 7.6.2
cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*
Original advisory text
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key c...
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
2% chance of attack within 30 days
Type
CWE-266Incorrect Privilege Assignment
CWE-269Improper Privilege Management
Timeline
Published31 Mar 2020
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-gfv5-grx2-9jw2 · GHSA
CVE-2020-7009 · NVD
CVE-2020-7009 · OSV
Track software like this
Free during beta