CVE-2017-8441: Elastic X-Pack

Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days.

Elastic X-Pack Security versions prior to 5.4.1 and 5.3.3 did not always correctly apply Document Level Security to index aliases. This bug could allow a user with restricted permissions to view data they should not have access to when performing certain operations against an index alias.

Affected products

• Elastic X-Pack: from 5.3.0, before 5.3.3 (fixed in 5.3.3); from 5.4.0, before 5.4.1 (fixed in 5.4.1)

Published 2017-06-05. Last modified 2026-06-17.