High severity · published Jun 3, 2020
CVE-2020-7010
Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator
7.5
CVSS
1.4%
EPSS
No
On KEV
Description
Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the current Elastic Stack cluster was deployed they may be able to more easily brute force the Elasticsearch credentials generated by ECK.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
Elastic Cloud ON Kubernetes · Elastic
before 1.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-7010
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-7010
Vendor Advisory
https://www.elastic.co/community/security/
More from Elastic Cloud ON Kubernetes
6.5
CVE-2026-72640
Unintended Proxy or Intermediary in Elastic Cloud on Kubernetes Leading to Cross-Namespace Secret Disclosure
6.5
CVE-2026-72648
Cleartext Storage of Sensitive Information in an Environment Variable in Elastic Cloud on Kubernetes Leading to Information Disclosure
5.4
CVE-2026-78609
Incorrect Authorization in Elastic Cloud on Kubernetes Leading to Unauthorized Modification of Data
5.3
CVE-2023-31416
Secret token configuration is never applied when using ECK <2.8 with APM Server >=8.0
3.5
CVE-2026-78600
Incomplete Cleanup in Elastic Cloud on Kubernetes Leading to Unauthorized Cross-Namespace Credential Retention