CVE-2018-3831

score

<0.1

cvss

8.8

epss

2.0%

published

2018-09-19

kev added

—

first seen

2026-10-21

Elasticsearch versions before 6.4.1 or 5.6.12 contain an information disclosure caused by the _cluster/settings API exposing sensitive configuration details, letting authenticated users view passwords, tokens, or usernames, exploit requires authenticated access.