Elasticsearch vulnerabilities

Improper authentication in the Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. An attacker would need such a certificate signed by a trusted CA.

Elasticsearch inserts sensitive information into log files when auditing requests to the reindex API. Under specific preconditions, this can lead to a loss of confidentiality.