CVE-2021-22132

Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in the cluster. This issue is fixed in Elasticsearch 7.10.2

• CWE-522
• CWE-522

• https://discuss.elastic.co/t/elasticsearch-7-10-2-security-update/261164Release Notes, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20210219-0004/Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
• https://discuss.elastic.co/t/elasticsearch-7-10-2-security-update/261164Release Notes, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20210219-0004/Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory

Published

Jan 14, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-22127An improper input validation vulnerability in FortiClient fo…8
• CVE-2021-22128An improper access control vulnerability in FortiProxy SSL V…4.3
• CVE-2021-22129Multiple instances of incorrect calculation of buffer size i…8.8
• CVE-2021-2213Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-22130A stack-based buffer overflow vulnerability in FortiProxy ph…4.9
• CVE-2021-22131A improper validation of certificate with host mismatch in F…5.4
• CVE-2021-22133The Elastic APM agent for Go versions before 1.11.0 can leak…2.4
• CVE-2021-22134A document disclosure flaw was found in Elasticsearch versio…4.3
• CVE-2021-22135Elasticsearch versions before 7.11.2 and 6.8.15 contain a do…5.3
• CVE-2021-22136In Kibana versions before 7.12.0 and 6.8.15 a flaw in the se…3.5
• CVE-2021-22137In Elasticsearch versions before 7.11.2 and 6.8.15 a documen…5.3
• CVE-2021-22138In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.…3.7