CVE-2020-7009: Elastic Elasticsearch

High severity, CVSS 8.8. EPSS: 1.6% chance of exploitation in the next 30 days.

Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.

Affected products

• Elastic Elasticsearch: from 6.7.0, before 6.8.8 (fixed in 6.8.8); from 7.0.0, before 7.6.2 (fixed in 7.6.2)

Published 2020-03-31. Last modified 2026-06-17.