High severity7.5NVD Advisory· Published Jul 21, 2021· Updated Jun 17, 2026

CVE-2021-22146

Description

All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters. While in the default setting the anonymous user has no permissions and is unable to successfully query any Elasticsearch APIs, an attacker could leverage the anonymous user to gain insight into certain details of a deployed cluster.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Elastic/Elasticsearch
cpe:2.3:a:elastic:elasticsearch:7.13.3:*:*:*:*:*:*:*
Elastic/Cloud Enterprisecpe-rescue
Elastic Cloud Enterprise/Elastic Cloud Enterprisellm-create
osv-coords
pkg:bitnami/elasticsearch
Range: >= 7.13.3, < 7.13.4

Patches

Vulnerability mechanics

References

packetstormsecurity.com/files/163655/Elasticsearch-ECE-7.13.3-Database-Disclosure.htmlnvdExploitThird Party AdvisoryVDB Entry
discuss.elastic.co/t/elastic-cloud-enterprise-security-update/279180nvdVendor Advisory
security.netapp.com/advisory/ntap-20210819-0005/nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.022
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000