CVE-2018-3825

Severity: medium (CVSS 5.9 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-09-19 · updated 2026-06-17
Weakness: CWE-321

Description

In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper access to Elasticsearch clusters. Unless explicitly overwritten, this master key is predictable across all ECE deployments. If an attacker can connect to ZooKeeper directly they would be able to access configuration information of other tenants if their cluster ID is known.

Affected products

Elastic Cloud Enterprise: before 1.1.4 — fixed in 1.1.4

How to fix

Upgrade to a fixed version: Elastic Cloud Enterprise 1.1.4. Check the vendor advisory for mitigations.

References

https://discuss.elastic.co/t/elastic-cloud-enterprise-1-1-4-security-update/135778
https://www.elastic.co/community/security
https://discuss.elastic.co/t/elastic-cloud-enterprise-1-1-4-security-update/135778
https://www.elastic.co/community/security

Get alerted when CVE-2018-3825 or the next vulnerability affects your stack