CVE-2021-37937: Elastic Elasticsearch

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

An issue was found with how API keys are created with the Fleet-Server service account. When an API key is created with a service account, it is possible that the API key could be created with higher privileges than intended. Using this vulnerability, a compromised Fleet-Server service account could escalate themselves to a super-user.

Affected products

• Elastic Elasticsearch: from 7.13.0, up to and including 7.14.0

Published 2023-11-22. Last modified 2026-06-17.