WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product: Elasticsearch✕
Overview 24 matches · 16 in Waratek scope · 2 protected · 1 exploited · 1 CISA KEV · 3 public PoC · 2 EPSS ≥ 0.5
24matches 16in Waratek scope66.7% 2protected8.3% 1exploited4.2% 1CISA KEV4.2% 3public PoC12.5% 2EPSS ≥ 0.58.3%
Protected by Waratek 2 8.3% Rule in development 0 0.0% Mitigation candidate 1 4.2% No exploit published 13 54.2% Outside Waratek scope 0 0.0% Not applicable 8 33.3% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 24 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 8.3% partly blocked 0 0.0% not blocked 22 91.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 4.2% Working exploit published 1 4.2% Proof of concept only 1 4.2% Forecast only 0 0.0% No public exploit 21 87.5%
split by peak 5 / year
Not applicable: 8No exploit published: 13Mitigation candidate: 1Protected by Waratek: 2 High: 24 not blocked: 22blocked by ARMR today: 2 No public exploit: 21Proof of concept only: 1Working exploit published: 1Exploited: 1
20141 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1 20150 20160 20171 No exploit published1 High1 not blocked1 No public exploit1 20181 No exploit published1 High1 not blocked1 No public exploit1 20191 Not applicable1 High1 not blocked1 No public exploit1 20202 No exploit published2 High2 not blocked2 No public exploit2 20211 Not applicable1 High1 not blocked1 Working exploit published1 20221 No exploit published1 High1 not blocked1 No public exploit1 20235 Protected by Waratek1 Mitigation candidate1 No exploit published2 Not applicable1 High5 blocked by ARMR today1 not blocked4 Proof of concept only1 No public exploit4 20242 No exploit published2 High2 not blocked2 No public exploit2 20254 No exploit published4 High4 not blocked4 No public exploit4 20265 Not applicable5 High5 not blocked5 No public exploit5
2014201620182020202220242026
24 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-103009 High 2026-10-06 Not applicable No public exploit Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass weakness in its handling of cross-cluster search requests made through the Remote Cluster Security (RCS) 2.0 model. An authorization check validates a request against one identifying attribute of the target shard, while a separate, independently-supplied identifying attribute in the same request determines which shard is actually accessed. A holder of a cross-cluster API key authorized for one index can craft a request whose two identifying attributes refer to different indices, causing the request to be authorized against an index they can access while actually operating against a different, unauthorized index. This can expose that index's document contents, field mappings, and other metadata, and in limited cases allows modification of retention-lease state on the unauthorized index.
CVE-2026-103007 High 2026-10-06 Not applicable No public exploit Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator delegate limited role-management capability to another user, scoped to specific indices. The authorization check that enforces this scoping does not correctly account for a role-definition setting that can expand the matched index set. A user holding this delegated privilege with a broadly-scoped index pattern can exploit this inconsistency by updating their own assigned role to gain access to indices that should remain restricted, including internal security data. This can enable further escalation up to full administrative control of the cluster.
CVE-2026-78607 High 2026-09-01 Not applicable No public exploit Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges could cause outbound inference traffic to be directed to a destination of their choosing and could cause administrator-provisioned credentials to be exposed.
CVE-2026-72649 High 2026-09-01 Not applicable No public exploit Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Injection (CAPEC-586). A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface than intended. Exploitation requires an authenticated user with sufficient privileges to create and deploy trained models.
CVE-2026-72642 High 2026-08-13 Not applicable No public exploit The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storage. A user with the privileges required to upload and deploy a trained model can craft a model that reads and writes memory outside the intended allocation. The result is heap corruption that crashes the inference process, and, with sufficient control over the heap layout, could allow arbitrary code execution in the context of that process.
CVE-2025-37731 High 2025-12-15 No exploit published No public exploit Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.
CVE-2024-52979 High 2025-05-01 No exploit published No public exploit Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the Elasticsearch node to crash.
CVE-2024-52981 High 2025-04-08 No exploit published No public exploit An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow.
CVE-2024-43709 High 2025-01-21 No exploit published No public exploit An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function.
CVE-2024-23444 High 2024-07-31 No exploit published No public exploit It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Requests, the associated private key that is generated is stored on disk unencrypted even if the --pass parameter is passed in the command invocation.
CVE-2024-23450 High 2024-03-27 No exploit published No public exploit A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.
CVE-2023-46674 High 2023-12-05 Protected by Waratek No public exploit An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon Web Services for reporting this issue.
CVE-2023-46673 High 2023-11-22 No exploit published No public exploit It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulate Pipeline API.
CVE-2021-37937 High 2023-11-22 Not applicable No public exploit An issue was found with how API keys are created with the Fleet-Server service account. When an API key is created with a service account, it is possible that the API key could be created with higher privileges than intended. Using this vulnerability, a compromised Fleet-Server service account could escalate themselves to a super-user.
CVE-2023-31419 High 2023-10-26 Mitigation candidate Proof of concept only A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.
CVE-2023-31418 High 2023-10-26 No exploit published No public exploit An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests. The issue was identified by Elastic Engineering and we have no indication that the issue is known or that it is being exploited in the wild.
CVE-2022-23712 High 2022-06-06 No exploit published No public exploit A Denial of Service flaw was discovered in Elasticsearch. Using this vulnerability, an unauthenticated attacker could forcibly shut down an Elasticsearch node with a specifically formatted network request.
CVE-2021-22146 High 2021-07-21 Not applicable Working exploit published All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters. While in the default setting the anonymous user has no permissions and is unable to successfully query any Elasticsearch APIs, an attacker could leverage the anonymous user to gain insight into certain details of a deployed cluster.
CVE-2020-7014 High 2020-06-03 No exploit published No public exploit The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and also authentication tokens. An attacker who is able to generate an API key and an authentication token can perform a series of steps that result in an authentication token being generated with elevated privileges.
CVE-2020-7009 High 2020-03-31 No exploit published No public exploit Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.
CVE-2019-7611 High 2019-03-25 Not applicable No public exploit A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the _aliases, _shrink, or _split endpoints are used . If the elasticsearch.yml file has xpack.security.dls_fls.enabled set to false, certain permission checks are skipped when users perform one of the actions mentioned above, to make existing data available under a new index/alias name. This could result in an attacker gaining additional permissions against a restricted index.
CVE-2018-3831 High 2018-09-19 No exploit published No public exploit Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elasticsearch _cluster/settings API, when queried, could leak sensitive configuration information such as passwords, tokens, or usernames. This could allow an authenticated Elasticsearch user to improperly view these details.
CVE-2015-4165 High 2017-08-09 No exploit published No public exploit The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files and execute code from them, is accessible by the attacker, and the Java VM on which Elasticsearch is running can write to a location that the other application can read and execute from, allows remote authenticated users to write to and create arbitrary snapshot metadata files, and potentially execute arbitrary code.
CVE-2014-3120 High 2014-07-28 Protected by Waratek Exploited The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.