CVE-2024-37282: Elastic Cloud Enterprise

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

It was identified that under certain specific preconditions, an API key that was originally created with a specific privileges could be subsequently used to create new API keys that have elevated privileges.

Affected products

• Elastic Elastic Cloud Enterprise: from 3.0.0, before 3.7.2 (fixed in 3.7.2)

Published 2024-06-28. Last modified 2026-06-17.