CVE-2021-22138

In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature. When specifying a trusted server CA certificate Logstash would not properly verify the certificate returned by the monitoring server. This could result in a man in the middle style attack against the Logstash monitoring data.

• CWE-295
• CWE-295

• https://discuss.elastic.co/t/elastic-stack-7-12-0-and-6-8-15-security-update/268125Vendor Advisory
• https://security.netapp.com/advisory/ntap-20210629-0001/Third Party Advisory
• https://discuss.elastic.co/t/elastic-stack-7-12-0-and-6-8-15-security-update/268125Vendor Advisory
• https://security.netapp.com/advisory/ntap-20210629-0001/Third Party Advisory

Published

May 13, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-22132Elasticsearch versions 7.7.0 to 7.10.1 contain an informatio…4.8
• CVE-2021-22133The Elastic APM agent for Go versions before 1.11.0 can leak…2.4
• CVE-2021-22134A document disclosure flaw was found in Elasticsearch versio…4.3
• CVE-2021-22135Elasticsearch versions before 7.11.2 and 6.8.15 contain a do…5.3
• CVE-2021-22136In Kibana versions before 7.12.0 and 6.8.15 a flaw in the se…3.5
• CVE-2021-22137In Elasticsearch versions before 7.11.2 and 6.8.15 a documen…5.3
• CVE-2021-22139Kibana versions before 7.12.1 contain a denial of service vu…6.5
• CVE-2021-2214Vulnerability in the Oracle WebLogic Server product of Oracl…4.4
• CVE-2021-22140Elastic App Search versions after 7.11.0 and before 7.12.0 c…7.5
• CVE-2021-22141An open redirect flaw was found in Kibana versions before 7.…6.1
• CVE-2021-22142Kibana contains an embedded version of the Chromium browser …8.8
• CVE-2021-22143The Elastic APM .NET Agent can leak sensitive HTTP header in…4.3