onyx

onyx --cves cve-2021-22146

CVE-2021-22146

HIGHPOCElasticsearch
score
<0.1
cvss
7.5
epss
35.8%
published
2021-07-21
kev added
—
first seen

Elastic Cloud Enterprise versions have the 'anonymous' user enabled by default in deployed Elasticsearch clusters, letting attackers potentially gain insight into cluster details, exploit requires no special privileges.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

events2021-07-21 — PublishedP2026-10-21 — Tracked by OnyxT2026-10-21 — Public PoC: http://packetstormsecurity.com/files/163655/Elasticsearch-ECE-7.13.3-Database-Disclosure.htmlXscore2026-10-21: score <0.1<0.1epss2026-09-22: epss 35.8%2026-09-23: epss 35.8%2026-09-24: epss 35.8%2026-09-25: epss 35.8%2026-09-26: epss 35.8%2026-09-27: epss 35.8%2026-09-28: epss 35.8%2026-09-29: epss 35.8%2026-09-30: epss 35.8%2026-10-01: epss 35.8%2026-10-02: epss 35.8%2026-10-03: epss 35.8%2026-10-04: epss 35.8%2026-10-05: epss 35.8%2026-10-06: epss 35.8%2026-10-07: epss 35.8%2026-10-08: epss 35.8%2026-10-09: epss 35.8%2026-10-10: epss 35.8%2026-10-11: epss 35.8%2026-10-12: epss 35.8%2026-10-13: epss 35.8%2026-10-14: epss 35.8%2026-10-15: epss 35.8%2026-10-16: epss 35.8%2026-10-18: epss 35.8%2026-10-19: epss 35.8%2026-10-20: epss 35.8%2026-10-21: epss 35.8%35.8%mentions/day0no mentions in 30 days2026-09-22today
  1. Published
  2. Tracked by Onyx
  3. Public PoC http://packetstormsecurity.com/files/163655/Elasticsearch-ECE-7.13.3-Database-Disclosure.html

Exploit availability

Weaknesses

NVD-CWE-Other

References 3