CVE-2022-23708: Elastic Elasticsearch

Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days.

A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “*” index permissions access to this index.

Affected products

• Elastic Elasticsearch: from 7.16.0, before 7.17.1 (fixed in 7.17.1)

Published 2022-03-03. Last modified 2026-06-17.