CVE-2020-7009
Improper Privilege Management in Elasticsearch
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.
- Record
CVE-2020-7009- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-266, CWE-269
- Updated
- 2026-11-02
CVE List No score
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.
- Record
CVE-2020-7009- Weakness
- CWE-266
- Updated
- 2026-11-02
EUVDEUVD-2022-3946 No score
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.
- Record
EUVD-2022-3946- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gfv5-grx2-9jw2
Improper Privilege Management in Elasticsearch
Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.
- Record
GHSA-gfv5-grx2-9jw2- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-266, CWE-269
- Updated
- 2026-11-02
OSV
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.
- Record
CVE-2020-7009- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-gfv5-grx2-9jw2
Improper Privilege Management in Elasticsearch
Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.
- Record
GHSA-gfv5-grx2-9jw2- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-266, CWE-269
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-7009
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.
- Record
UBUNTU-CVE-2020-7009- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBIT-elasticsearch-2020-7009 No score
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.
- Record
BIT-elasticsearch-2020-7009- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.elasticsearch:elasticsearchMaven |
6.7.0 to 6.8.7 | 6.8.8 |
org.elasticsearch:elasticsearchMaven |
7.0.0 to 7.6.1 | 7.6.2 |
elasticsearchBitnami |
6.7.0 up to 6.8.8, 7.0.0 up to 7.6.2 | 6.8.87.6.2 |
org.elasticsearch:elasticsearchMaven |
6.7.0 up to 6.8.8, plus listed versions 6.7.16.7.26.8.06.8.16.8.2 Show 5 moreShow less6.8.36.8.46.8.56.8.66.8.7 |
6.8.8 |
org.elasticsearch:elasticsearchMaven |
7.0.0 up to 7.6.2, plus listed versions 7.0.17.1.07.1.17.2.07.2.1 Show 11 moreShow less7.3.07.3.17.3.27.4.07.4.17.4.27.5.07.5.17.5.27.6.07.6.1 |
7.6.2 |
elasticsearchUbuntu:16.04:LTS |
All versions, plus listed versions 1.6.2+dfsg-11.7.3+dfsg-11.7.3+dfsg-21.7.3+dfsg-3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-7009 is a high vulnerability (CVSS 8.8) in Elastic Elasticsearch, published March 31, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.88%, the 79th percentile. Fixed in org.elasticsearch:elasticsearch 6.8.8.
References
elastic.co/community/security
discuss.elastic.co/t/elastic-stack-6-8-8-and-7-6-2-security-update/225920
security.netapp.com/advisory/ntap-20200403-0004
nvd.nist.gov/vuln/detail/CVE-2020-7009
github.com/advisories/GHSA-gfv5-grx2-9jw2
ubuntu.com/security/CVE-2020-7009
cve.org/CVERecord?id=CVE-2020-7009