CVE-2021-22146 in the critical feed json
All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters.
published 2021-07-21 5 y ago modified 2026-09-08 2 mo ago also BIT-elasticsearch-2021-22146 , EUVD-2021-9294
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 35.8%
- EPSS 35.8% chance of exploitation in 30 days, percentile 98%
- public exploits
- 1
- Exploit-DB
Summary
All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters. While in the default setting the anonymous user has no permissions and is unable to successfully query any Elasticsearch APIs, an attacker could leverage the anonymous user to gain insight into certain details of a deployed cluster.
Patch / fix
- bitnami elasticsearch 7.13.4
Timeline
- Published
- First public exploit (EDB-50152)
Exploit prediction
35.78% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-50152 Elasticsearch ECE 7.13.3 - Anonymous Database Dump webapps, 2021-07-26
- packetstormsecurity.com http://packetstormsecurity.com/files/163655/Elasticsearch-ECE-7.13.3-Database-Disclosure.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | elasticsearch | >=7.13.3, <7.13.4 |
7.13.4 |
References
-
packetstormsecurity.com
/files/163655/Elasticsearch-ECE-7.13.3-Database-Disclosure.html
exploit, third-party-advisory, vdb-entry, advisory
-
discuss.elastic.co
/t/elastic-cloud-enterprise-security-update/279180
vendor-advisory, advisory
-
security.netapp.com
/advisory/ntap-20210819-0005/
third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-22146
web
Sources
- CVE List CVE-2021-22146
- NVD CVE-2021-22146
- OSV BIT-elasticsearch-2021-22146
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.