Elastic Elasticsearch
52 CVEs affecting Elastic Elasticsearch. Latest disclosed: 2026-07-01. Critical: 2, High: 9.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-5377 | Critical | 9.8 | 2018-03-06 | Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol. NOTE: ZDI appears to cl… |
CVE-2015-1427 | Critical | 9.8 | 2015-02-17 | The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute… |
CVE-2020-7014 | High | 8.8 | 2020-06-03 | The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an a… |
CVE-2020-7009 | High | 8.8 | 2020-03-31 | Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacke… |
CVE-2018-3831 | High | 8.8 | 2018-09-19 | Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elas… |
CVE-2019-7611 | High | 8.1 | 2019-03-25 | A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the _alia… |
CVE-2018-3827 | High | 8.1 | 2018-09-19 | A sensitive data disclosure flaw was found in the Elasticsearch repository-azure (formerly elasticsearch-cloud-azure) plugin. When the repository-azure plugin… |
CVE-2014-3120 | High | 8.1 | 2014-07-28 | The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java c… |
CVE-2023-31418 | High | 7.5 | 2023-10-26 | An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to e… |
CVE-2022-23712 | High | 7.5 | 2022-06-06 | A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability, an unauthenticated attacker could forcibly shut down an Elasticsearch node… |
CVE-2021-22146 | High | 7.5 | 2021-07-21 | All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters. While in the default setting the anony… |
CVE-2025-37731 | Medium | 6.8 | 2025-12-15 | Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to ha… |
CVE-2026-49090 | Medium | 6.5 | 2026-07-01 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can su… |
CVE-2026-56148 | Medium | 6.5 | 2026-07-01 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a spec… |
CVE-2025-68384 | Medium | 6.5 | 2025-12-18 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CA… |
CVE-2024-52979 | Medium | 6.5 | 2025-05-01 | Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service… |
CVE-2024-52980 | Medium | 6.5 | 2025-04-08 | A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class could cause the Elast… |
CVE-2024-43709 | Medium | 6.5 | 2025-01-21 | An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted… |
CVE-2024-12539 | Medium | 6.5 | 2024-12-17 | An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security… |
CVE-2024-23445 | Medium | 6.5 | 2024-06-12 | It was identified that if a cross-cluster API key https://www.elastic.co/guide/en/elasticsearch/reference/8.14/security-api-create-cross-cluster-api-key.html#… |