CVE-2018-17244

score

<0.1

cvss

6.5

epss

1.5%

published

2018-12-20

kev added

—

first seen

2026-10-21

Elasticsearch Security versions 6.4.0 to 6.4.2 contain a header handling error in request processing for Active Directory, LDAP, Native, or File realms, letting concurrent requests with the same username receive incorrect headers, potentially causing requests to run as the wrong user, and allowing unauthorized access.