CVE-2024-23444

score

<0.1

cvss

4.9

epss

0.2%

published

2024-07-31

kev added

—

first seen

2026-10-21

Elasticsearch-certutil contains a security flaw where the private key generated with the csr option is stored unencrypted on disk even when the --pass parameter is used, letting local attackers access private keys, exploit requires local access to the system.