products / elasticsearch

Elasticsearch

Elasticsearch is Elastic's distributed search and analytics engine. Clusters store and query JSON documents over HTTP and are commonly exposed inside observability and search stacks. NVD tracks the product as elastic:elasticsearch with standard dotted stack versions (1.x through 8.x). Early releases shipped dynamic scripting that became unchecked RCE surface. Later CVEs target API-key privilege boundaries and query parsers that can crash a node.

api usage

Querying Elasticsearch

product slugelasticsearch

version format7.13.3, 8.11.1, 1.4.2

bash

curl "https://api.attestd.io/v1/check?product=elasticsearch&version=7.13.3" \
  -H "Authorization: Bearer $ATTESTD_KEY"

Elasticsearch 7.13.3 is affected by CVE-2021-22145 (error responses can disclose document fragments and field values). The response shows risk_state: "high" because the issue is remotely reachable and a patch is available, while the CVE is not on the CISA KEV catalog.

json

{
  "product": "elasticsearch",
  "version": "7.13.3",
  "supported": true,
  "risk_state": "critical",
  "risk_factors": [
    "remote_code_execution",
    "no_authentication_required",
    "internet_exposed_service",
    "patch_available"
  ],
  "actively_exploited": false,
  "remote_exploitable": true,
  "authentication_required": false,
  "patch_available": true,
  "fixed_version": null,
  "confidence": 0.5,
  "cve_ids": [
    "CVE-2021-22145",
    "CVE-2021-22146",
    "CVE-2021-22147",
    "CVE-2021-37937",
    "CVE-2023-31417",
    "CVE-2023-31418",
    "CVE-2023-31419",
    "CVE-2023-46673",
    "CVE-2023-46674",
    "CVE-2023-49921",
    "CVE-2024-23444",
    "CVE-2024-23450",
    "CVE-2024-52979",
    "CVE-2025-37727",
    "CVE-2025-37731",
    "CVE-2025-68384",
    "CVE-2025-68390",
    "CVE-2026-49090",
    "CVE-2026-72683"
  ],
  "cves": null,
  "max_epss": 0.76249,
  "last_updated": "2026-08-16T11:18:08.825063Z",
  "supply_chain": {
    "compromised": false,
    "sources": [],
    "malware_type": null,
    "description": null,
    "advisory_url": null,
    "compromised_at": null,
    "removed_at": null,
    "source_published_at": null,
    "observed_at": null,
    "ingested_at": null,
    "first_served_at": null,
    "provenance": null
  },
  "supply_chain_monitored": true,
  "typosquat": null
}

safe version

Elasticsearch 8.19.19 is past the CVE-2021-22145 fix line (7.13.4+) and outside the CVE-2023-31419 stack-overflow ranges on 7.x and 8.x.

bash

curl "https://api.attestd.io/v1/check?product=elasticsearch&version=8.19.19" \
  -H "Authorization: Bearer $ATTESTD_KEY"

notable cves

CVE history

The highest-severity Elasticsearch CVEs cluster around dynamic scripting in the 1.x era, when default Groovy and MVEL execution gave unauthenticated callers a path to Java on the node. Later issues shift to authenticated privilege boundaries (API keys) and denial of service in the search parser rather than default remote code execution.

CVE	Description	Affects	CVSS
`CVE-2015-1427`KEV	Groovy sandbox bypass executes arbitrary Java on the Elasticsearch node.	<1.3.8 / ≥1.4.0 <1.4.3	9.8
`CVE-2014-3120`KEV	Default dynamic scripting executes arbitrary MVEL/Java remotely.	<1.2	8.1
`CVE-2020-7009`	API-key creation privilege escalation when an attacker can create API keys.	≥6.7.0 <6.8.8 / ≥7.0.0 <7.6.2	8.8
`CVE-2023-31419`	Crafted _search query string stack-overflows the node (DoS).	≥7.0.0 ≤7.17.12 / ≥8.0.0 ≤8.9.0	7.5

KEV = CISA Known Exploited Vulnerabilities catalog. Active exploitation confirmed.

data sources

Elastic CPE namespace

NVD lists Elasticsearch under the Elastic vendor CPE. Older elasticsearch:elasticsearch tags appear on some legacy records; Attestd normalizes both onto the product slug.

cpe:2.3:a:elastic:elasticsearchPrimary NVD namespace for current stack releases

cpe:2.3:a:elasticsearch:elasticsearchLegacy vendor string on older CVE records

Query product=elasticsearch with a dotted stack version. Attestd matches the version against the affected ranges and returns the aggregated risk state.

All products Log4j MongoDB Quickstart