CVE-2021-37937 — Elasticsearch privilege escalation
An issue was found with how API keys are created with the Fleet-Server service account. When an API key is created with a service account, it is possible that the API key could …
Published: 2023-11-22 · CVSS: 5.9 · CVSS 3.1
An issue was found with how API keys are created with the Fleet-Server service account. When an API key is created with a service account, it is possible that the API key could be created with higher privileges than intended. Using this vulnerability, a compromised Fleet-Server service account could escalate themselves to a super-user.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7