Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2020-7009: Elasticsearch API Keys Can Be Used for Privilege Escalation
CVE-2020-7009 · published 6 years ago
Summary
Attackers who can create API keys in Elasticsearch can gain elevated access to the system. This can happen if Elasticsearch versions 6.7.0 to 6.8.7 or 7.0.0 to 7.6.1 are being used. To fix this, update to a non-vulnerable version of Elasticsearch.
What to do
- Update elasticsearch org.elasticsearch:elasticsearch to version 6.8.8.
- Update elasticsearch org.elasticsearch:elasticsearch to version 7.6.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | elasticsearch | org.elasticsearch:elasticsearch |
>= 6.7.0, <= 6.8.7 >= 7.0.0, <= 7.6.1 Fix: upgrade to 6.8.8
|
Original advisory text
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key c...
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.
Severity
8.8
High
CVSS 3.1: 8.8 (GHSA)
Exploitation
EPSS 2%
Type
CWE-266Incorrect Privilege Assignment
CWE-269Improper Privilege Management
Timeline
Published31 Mar 2020
Updated15 Aug 2026
First seen6 Mar 2026
Monitor software like this
Free during beta