Elastic

Records415All Threatist records

Exploited (KEV)3In CISA KEV

CVSS critical22CVSS 9.0–10.0

CVSS high119CVSS 7.0–8.9

Exploited now

Elastic records in CISA KEV

TI-2014-02491 Elasticsearch Remote Code Execution Vulnerability CRITICAL 92KEV 2022-03-25 TI-2015-01295 Elasticsearch Groovy Scripting Engine Remote Code Execution Vulnerability CRITICAL 100KEV 2022-03-25 TI-2019-05363 Kibana Arbitrary Code Execution CRITICAL 100KEV 2022-01-10

Components

Products in the NVD configurations · select one to filter the records

Kibana 189 records CRITICAL Elasticsearch 91 records CRITICAL Elastic Cloud Enterprise 16 records MEDIUM Logstash 13 records MEDIUM X-pack 9 records MEDIUM Elastic Agent 6 records LOW Elastic Cloud On Kubernetes 6 records MEDIUM Endpoint Security 6 records LOW

Records

6 records in Elastic Cloud On Kubernetes · all components

TI-2020-05658 CVE-2020-7010 · GHSA-vfp4-xx6m-7vf6

Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak…

MEDIUM 42

Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01435 Published 2020-06-03 Fixed in 1.1.0 CWE-335

TI-2023-15034 CVE-2023-31416 · GHSA-f827-q6f2-jc9c

Elastic Cloud on Kubernetes (ECK) secret token configuration issue

LOW 30

Secret token configuration is never applied when using ECK <2.8 with APM Server >=8.0.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00428 Published 2023-10-26 Fixed in 2.8 CWE-200

TI-2026-50886 CVE-2026-72648 · GHSA-994r-4f38-cvgv

Cleartext Storage of Sensitive Information in an Environment Variable in Elastic Cloud on…

LOW 29

Cleartext Storage of Sensitive Information in an Environment Variable (CWE-526) in Elastic Cloud on Kubernetes (ECK) can lead to information disclosure via Retrieve Embedded Sensitive Data (CAPEC-37).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00426 Published 2026-08-13 No fix listed CWE-526

TI-2026-50879 CVE-2026-72640 · GHSA-vvr2-6gx7-cxv9

Unintended Proxy or Intermediary in Elastic Cloud on Kubernetes Leading to Cross-Namespace Secret Disclosure

LOW 29

The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an annotation on secrets it manages, and it accepts the namespace recorded in each reference without validating that the reference is…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00375 Published 2026-08-13 No fix listed CWE-441

TI-2026-54658 CVE-2026-78609 · GHSA-h699-694r-9xxf

Incorrect Authorization in Elastic Cloud on Kubernetes Leading to Unauthorized Modification of Data

LOW 23

Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data via Metadata Spoofing (CAPEC-690).

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.0015 Published 2026-09-02 No fix listed CWE-863

TI-2026-54649 CVE-2026-78600 · GHSA-pr5w-c42r-pmjr

Incomplete Cleanup in Elastic Cloud on Kubernetes Leading to Unauthorized Cross-Namespace Credential Retention

LOW 17

Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122).

CVSS 3.1LOW 3.5 Network Low privileges No interaction EPSS 0.00284 Published 2026-09-02 No fix listed CWE-459

Open these records in search →

Critical	22
High	119
Medium	267
Low	7
No CVSS	0