CVE-2020-7009 Improper Privilege Management in Elasticsearch
Attackers with API key creation rights can escalate privileges in Elasticsearch, requiring upgrades to secure the search engine.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-7009?
CVE-2020-7009 is a high-severity vulnerability in Elastic Elasticsearch, published on 31 Mar 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.
Which versions are affected by CVE-2020-7009?
5 open source packages ship an affected version, including org.elasticsearch:elasticsearch and elasticsearch. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.elasticsearch:elasticsearch Maven | From 6.7.0 | 6.8.8 |
org.elasticsearch:elasticsearch Maven | From 6.7.0 | 6.8.8 |
org.elasticsearch:elasticsearch Maven | From 7.0.0 | 7.6.2 |
org.elasticsearch:elasticsearch Maven | From 7.0.0 | 7.6.2 |
elasticsearch Bitnami | From 6.7.0 | 6.8.8, 7.6.2 |
Products include Elastic Elasticsearch.
How do I fix CVE-2020-7009?
Upgrade org.elasticsearch:elasticsearch to a fixed version for your release line: 6.8.8 or 7.6.2.
Is CVE-2020-7009 being exploited?
There is no known exploitation of CVE-2020-7009 in the wild and no public exploit code.
Other vulnerabilities in Elastic Elasticsearch
- CVE-2015-1427 Elasticsearch Groovy Scripting Engine Remote Code Execution
- CVE-2014-3120 Elasticsearch Remote Code Execution
- CVE-2015-5377 Code injection in n/a
- CVE-2026-72649 Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution
- CVE-2026-72642 Use of Out-of-range Pointer Offset in the Elasticsearch Machine Learning Native Inference Process
Sources
Also known as BIT-elasticsearch-2020-7009, GHSA-gfv5-grx2-9jw2, UBUNTU-CVE-2020-7009.