CVE-2019-7619: Exposure of Sensitive Information in Elasticsearch
Summary
CVE-2019-7619: Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch. Affects org.elasticsearch:elasticsearch across 2 version ranges.
>= 6.7.0, < 6.8.4
>= 7.0.0, < 7.4.0
Fixed in 6.8.4 or 7.4.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Elasticsearch is an open-source search and analytics engine that is widely used for storing and retrieving large amounts of data. It provides a distributed, RESTful search and analytics platform that can be used for various purposes, including log analysis, full-text search, and data visualization. The vulnerability identified as CVE-2019-7619 affects Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3. This vulnerability allows an unauthorized actor to gain access to sensitive information by exploiting a flaw in the API Key service. By sending a specially crafted request, an attacker can determine if a username exists in the Elasticsearch native realm.
Vulnerability Detail
The vulnerability arises from a username disclosure flaw in the API Key service of Elasticsearch. An unauthenticated attacker can exploit this flaw by sending a specially crafted request to the Elasticsearch server. By analyzing the server's response, the attacker can determine if a specific username exists in the Elasticsearch native realm. This information disclosure can be used by an attacker to gather intelligence about the system and potentially launch further attacks. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Latest published version: 9.5.5 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 6.7.0, < 6.8.46.8.4 -
>= 7.0.0, < 7.4.07.4.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix provided by Elasticsearch by upgrading to the fixed versions mentioned above.
Conclusion
The vulnerability identified as CVE-2019-7619 in Elasticsearch exposes sensitive information to unauthorized actors. To mitigate this vulnerability, it is crucial to upgrade to the fixed versions of Elasticsearch mentioned above. It is recommended to thoroughly test the upgrade process in a non-production environment before applying it to the production system. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.elasticsearch:elasticsearch →
FAQ
Elasticsearch is an open-source search and analytics engine used for storing and retrieving large amounts of data. It provides a distributed, RESTful search and analytics platform.
Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 are affected by this vulnerability.
This vulnerability allows an unauthorized actor to determine if a username exists in the Elasticsearch native realm, potentially leading to further attacks and unauthorized access to sensitive information.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of Elasticsearch mentioned above.
No, there is no known workaround for this vulnerability. Upgrading to the fixed versions is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for org.elasticsearch:elasticsearch.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
