CVE-2018-3826

score

<0.1

cvss

6.5

epss

0.7%

published

2018-09-19

kev added

—

first seen

2026-10-21

Elasticsearch versions 6.0.0-beta1 to 6.2.4 contain a disclosure flaw in the _snapshot API caused by exposing access_key and security_key parameters as plain text, letting users querying the API retrieve sensitive credentials, exploit requires access to the _snapshot API.