UpHeron
All vulnerabilities

Servers and applications

CVE-2020-7009

Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.

Severity
High 8.8
Published
31 Mar 2020
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
6.8.8, 7.6.2
Sources
NVD

Affected software

SoftwareAffected versions
ElasticsearchServers and applications · cpe:a:elastic:elasticsearch
  • From 6.7.0 before 6.8.8
  • From 7.0.0 before 7.6.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-7009
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-7009