Elasticsearch HTTP API
Elasticsearch exposes its search, indexing and cluster-administration functionality through a RESTful HTTP API rather than a binary wire protocol -- every request and response is plain JSON over HTTP, normally on port 9200, Elastic's own documented default rather than an IANA-assigned port. Before version 8.0, Elastic's security features (authentication, role-based access control, TLS) were part of a separate tier and disabled by default, so a freshly started node answered any HTTP request on that port with no credential required at all. Elastic's own 8.0 release notes confirm security is now enabled by default for self-managed clusters, closing that specific gap for new deployments. The ongoing risk is almost entirely inherited: clusters deployed on an older version, or ones where security was manually disabled during setup for convenience, that were never revisited -- which is how researchers keep finding large, completely open Elasticsearch indices.
By AdminKit team, Netbase JSC · Updated