CVE-2021-37937: 
Elasticsearch vulnerability analysis and mitigation

A privilege escalation vulnerability (CVE-2021-37937) was discovered in Elasticsearch versions 7.13.0 through 7.14.0. The vulnerability affects how API keys are created with the Fleet-Server service account, where an API key could potentially be created with higher privileges than intended (Elastic Advisory).

The vulnerability stems from an implementation flaw in the API key creation process for Fleet-Server service accounts. When an API key is created with a service account, the system fails to properly enforce privilege limitations. The vulnerability has a CVSS v3.1 base score of 5.9 (Medium) with the vector string AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N, indicating that it requires network access, high attack complexity, and high privileges to exploit (NVD).

If exploited, this vulnerability allows a compromised Fleet-Server service account to escalate its privileges to super-user status, potentially gaining full administrative access to the Elasticsearch system (Elastic Advisory).

Users should upgrade to Elasticsearch version 7.14.1 which contains the fix for this vulnerability. No alternative workarounds have been provided (Elastic Advisory).