CVE-2021-22148 - AskarLabs CVE Database

CVE-2021-22148

Vendor Elastic

Product Elastic Enterprise Search

Weakness CWE-732

Published September 15, 2021

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Elastic Enterprise Search App Search versions before 7.14.0 was vulnerable to an issue where API keys were not bound to the same engines as their creator. This could lead to a less privileged user gaining access to unauthorized engines.

Key dates

02Disclosure timeline

September 15, 2021 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-22148 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/732.html

Related vulnerabilities

04Related CVE

CVE-2025-49131 FastGPT Sandbox Vulnerable to Sandbox Bypass CVE-2025-69426 Ruckus vRIoT IoT Controller < 3.0.0.0 Hardcoded SSH Credentials RCE CVE-2021-4481 Dräger Protector Software Local Privilege Escalation via Insecure File Permissions CVE-2025-40574 CVE-2026-41489 Pi-hole: Local privilege escalation via config-controlled path in root-executed service hooks