UpHeron
All vulnerabilities

Servers and applications

CVE-2018-3826

In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the _snapshot API. When the access_key and security_key parameters are set using the _snapshot API they can be exposed as plain text by users able to query the _snapshot API.

Severity
Medium 6.5
Published
19 Sept 2018
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
ElasticsearchServers and applications · cpe:a:elastic:elasticsearch
  • Version 6.0.0-beta1
  • From 6.0.0 up to 6.2.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2018-3826
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2018-3826