Servers and applications
CVE-2021-22132
Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in the cluster. This issue is fixed in Elasticsearch 7.10.2
- Severity
- Medium 4.8
- Published
- 14 Jan 2021
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 21 Oct 2026
- Fixed in
- 7.10.2
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
ElasticsearchServers and applications · cpe:a:elastic:elasticsearch |
|