Elasticsearch API Key detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_SECRET_384
Category	API Keys
Severity	HIGH
Framework	Git

Impact

An Elasticsearch / Elastic Cloud API key in its encoded form (base64 of id:api_key) is used in the Authorization ApiKey header to authenticate to an Elasticsearch cluster. Exposure allows an attacker to read, write, or delete indices and documents and to perform any cluster operation permitted by the key's role descriptors, leading to data exfiltration, tampering, or service disruption.

How to Fix

Invalidate the exposed API key via the Elasticsearch Security API (DELETE _security/api_key) or Kibana Stack Management. Generate a new least-privilege key, distribute it via a secrets manager, and purge the leaked value from git history.