n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers

Impact The Elasticsearch and ElasticSecurity nodes built REST endpoints by interpolating user-provided identifiers straight into the request path. A value containing path separators or dot segments changed which endpoint the request actually reached, so an operation intended for one document coul...

hooker

Hooker: Automated Dynamic Analysis of Android Applications About Hooker Functional Description Hooker is an opensource project for dynamic analyses of Android applications. This project provides various tools and applications that can be use to automatically intercept and modify any API calls mad...

CVE-2014-3120

LAB 10-CVE-2014-3120 I. SYSTEM ANALYSIS Identifying the Attack Surface from the Docker Environment Starting with what is running in the environment. We list all active containers: root@kitploit: docker ps Result: Container p1/lab10:latest is running, exposing 2 ports externally: Port mapping|...

GHSA-FCCG-MWVH-QQG4 vulnerabilities

Vulnerabilities for packages: logstash, drain-cleaner-fips, tez, kayenta-fips, akhq, apache-nifi, cassandra, pinot, hono, request-9047-keycloak-fips, drain-cleaner, zookeeper-fips, apache-hop, spark-fips, apache-camel-karavan-devmode, kafka, knative-kafka-broker-fips, seata, keycloak, zookeeper,...

CVE-2026-75596 vulnerabilities

Vulnerabilities for packages: logstash, drain-cleaner-fips, tez, kayenta-fips, akhq, apache-nifi, cassandra, pinot, hono, request-9047-keycloak-fips, drain-cleaner, zookeeper-fips, apache-hop, spark-fips, apache-camel-karavan-devmode, kafka, knative-kafka-broker-fips, seata, keycloak, zookeeper,...

ElasticSearch v1.1.1/1.2 RCE

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to search. Be aware this only violates the vendor's intended security policy if the user does not run...

Apache Solr <= 7.1 - XML Entity Injection

Apache Solr with Apache Lucene before 7.1 is susceptible to remote code execution by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external...

RS4LOGJ-CVE-2021-44228

RS4LOGJ-CVE-2021-44228 Apache Log4j 漏洞 - CVE-2021-44228 远程 Syslog 说明： 远程 Syslog 使用 Elasticsearch 模块来保存日志。 受影响的产品： RSv2 RSE RSX RSC 不受影响。 检查： 检查版本： root@kitploit: curl -XGET 'http://localhost:9200' 输出： root@kitploit: "number" : "7.16.2" 或 root@kitploit: "number" : "6.8.22" Elasticsearch 官方文档：...

GHSA-C4C3-7FPV-J4Q5 vulnerabilities

Vulnerabilities for packages: logstash, drain-cleaner-fips, tez, kayenta-fips, akhq, apache-nifi, cassandra, pinot, hono, request-9047-keycloak-fips, drain-cleaner, zookeeper-fips, apache-hop, spark-fips, apache-camel-karavan-devmode, kafka, knative-kafka-broker-fips, seata, keycloak, zookeeper,...

Elasticsearch-CVE-2023-31419

Elasticsearch CVE 2023-31419 PoC...

exploit-CVE-2015-1427

Elasticsearch 1.4.0 1.4.2 Remote Code Execution Elasticsearch is a distributed, RESTful search and analytics engine capable of solving a growing number of use cases. As the heart of the Elastic Stack, it centrally stores your data so you can discover the expected and uncover the unexpected...

Elasticsearch 8.18.x < 8.19.20 / 9.0.x < 9.4.5 / 9.5.x < 9.5.1 Information Disclosure (ESA-2026-141)

The version of Elasticsearch installed on the remote host is 8.18.x prior to 8.19.20, or 9.0.x prior to 9.4.5, or 9.5.x prior to 9.5.1. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-141 advisory. - Inconsistent Interpretation of HTTP Requests 'HTTP Request Smuggling'...

Kibana 9.4.x < 9.4.5 Missing Authorization (ESA-2026-147)

The version of Kibana installed on the remote host is 9.4.x prior to 9.4.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-147 advisory. - Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization contro...

Elasticsearch 8.x < 8.19.20 / 9.0.x < 9.3.0 DoS (ESA-2026-47)

The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.20, or 9.0.x prior to 9.3.0. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-47 advisory. - Allocation of Resources Without Limits or Throttling CWE-770 in Elasticsearch can lead to a denial...

Elasticsearch 8.x < 8.19.20 / 9.0.x < 9.4.5 / 9.5.x < 9.5.1 RCE (ESA-2026-114)

The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.20, or 9.0.x prior to 9.4.5, or 9.5.x prior to 9.5.1. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-114 advisory. - Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine...

Kibana 9.0.x < 9.4.6 / 9.5.x < 9.5.1 Missing Authorization (ESA-2026-149)

The version of Kibana installed on the remote host is 9.0.x prior to 9.4.6, or 9.5.x prior to 9.5.1. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-149 advisory. - Missing Authorization CWE-862 in Kibana can lead to information disclosure via Exploiting Incorrectly...

Elasticsearch-Exploit-CVE-2023-31419

Elasticsearch StackOverflow vulnerability A flaw was discovered in Elasticsearch, affecting the search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service. Affected Versions: Elasticsearch versions from 7.0.0 to 7.17.12 and from 8.0.0 to...

CVE-2026-86079

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths. An identifier containing path separators or dot segments could...

CVE-2026-86079

CVE-2026-86079 affects n8n , an open-source workflow automation platform. The Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths without the required toPathSegment encoding (missing in GenericFunctions.ts). An i...

CVE-2026-86079 n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths. An identifier containing path separators or dot segments could...