CVE-2020-7010 Cryptographic Issues in ECK

What is CVE-2020-7010?

CVE-2020-7010 is a high-severity vulnerability in Elastic Cloud on Kubernetes, published on 3 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the current Elastic Stack cluster was deployed they may be able to more easily brute force the Elasticsearch credentials generated by ECK.

Weakness: CWE-335

Which versions are affected by CVE-2020-7010?

2 open source packages ship an affected version, including github.com/elastic/cloud-on-k8s. It affects 1 product.

Products include Elastic Elastic Cloud on Kubernetes.

How do I fix CVE-2020-7010?

Upgrade github.com/elastic/cloud-on-k8s to 1.1.0 or later.

Is CVE-2020-7010 being exploited?

There is no known exploitation of CVE-2020-7010 in the wild and no public exploit code.

Other vulnerabilities in Elastic Cloud on Kubernetes

• CVE-2026-72640 Unintended Proxy or Intermediary in Elastic Cloud on Kubernetes Leading to Cross-Namespace Secret Disclosure Medium 6.5
• CVE-2026-72648 Information disclosure in Eck Operator Medium 6.5
• CVE-2026-78609 Incorrect Authorization in Elastic Cloud on Kubernetes Leading to Unauthorized Modification of Data Medium 5.4
• CVE-2023-31416 Elastic Cloud on Kubernetes (ECK) secret token configuration issue Medium 5.3
• CVE-2026-78600 Incomplete Cleanup in Elastic Cloud on Kubernetes Leading to Unauthorized Cross-Namespace Credential Retention Low 3.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vfp4-xx6m-7vf6.