CVE-2015-1427: Improper Access Control in Elasticsearch
Summary
CVE-2015-1427: Improper Access Control in Elasticsearch. Affects org.elasticsearch:elasticsearch across 2 version ranges.
< 1.3.8
>= 1.4.0, < 1.4.3
Fixed in 1.3.8 or 1.4.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Elasticsearch is an open-source search and analytics engine built on Apache Lucene. It provides distributed, RESTful search capabilities and is commonly used for log analytics, full-text search, and data visualization. The vulnerability identified as CVE-2015-1427 affects Elasticsearch versions before 1.3.8 and 1.4.x before 1.4.3. This vulnerability allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
Vulnerability Detail
The vulnerability arises from a flaw in the Groovy scripting engine used by Elasticsearch. By exploiting this flaw, remote attackers can bypass the sandbox protection mechanism and execute arbitrary shell commands. This can lead to unauthorized access, data leakage, and potential compromise of the Elasticsearch server. The vulnerability is rated as HIGH severity and has been assigned CWE-284.
How To Fix
Latest published version: 9.5.5 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.3.81.3.8 -
>= 1.4.0, < 1.4.31.4.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can disable the Groovy scripting engine in Elasticsearch. This can be achieved by modifying the Elasticsearch configuration file and setting the 'script.groovy.sandbox.enabled' property to 'false'. However, this workaround may limit the functionality of certain Elasticsearch features that rely on Groovy scripting.
Conclusion
The vulnerability in Elasticsearch (CVE-2015-1427) allows remote attackers to execute arbitrary shell commands by bypassing the sandbox protection mechanism. To mitigate this vulnerability, it is crucial to upgrade Elasticsearch to the recommended fixed versions. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.elasticsearch:elasticsearch →
FAQ
Elasticsearch is an open-source search and analytics engine used for log analytics, full-text search, and data visualization.
Versions before 1.3.8 and 1.4.x before 1.4.3 are affected by this vulnerability.
Remote attackers can exploit this vulnerability by crafting a malicious script that bypasses the sandbox protection mechanism and executes arbitrary shell commands.
The vulnerability can lead to unauthorized access, data leakage, and potential compromise of the Elasticsearch server.
Yes, users can disable the Groovy scripting engine in Elasticsearch as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for org.elasticsearch:elasticsearch.
