Repository navigation
Elasticsearch instance unprotected, thus allowing an attacker to perform write/read operations on the database huly #7508
Description
Description of the issue
A clear and concise description of the issue.
i found bug Elasticsearch instance unprotected, thus allowing an attacker to perform write/read operations on the database huly
Your environment
- Version of Huly
- Browser (and version)
- Your operating system (and version)
Steps to reproduce
Please produce the steps for us to reproduce this issue.
1- i use for exploit bug and create poc in db by used in linux os
curl -XPUT 'http://23.94.180.12:9200/poc3' and see create poc in db
http://23.94.180.12:9200/poc3
and go to http://23.94.180.12:9200/huly_storage_index_v1/_search?size=1000 and see huly in url thats means own company
Expected behaviour
Tell us what should happen.
Actual behaviour
Tell us what happens instead (include screenshots or logs).
thus allowing an attacker to perform write/read operations on the huly
Possible solutions
(Not obligatory)
If you know how to fix the bug, please describe your solution here.
Activity
MichaelUray commentedon Oct 20, 2026
This looks like a report about the network exposure of one particular deployment rather than a defect in the self-hostable codebase, so it can only be handled by the service operators. If maintainers agree, please consider closing.
MichaelUray commentedon Oct 20, 2026
@shadihh9 — as explained above, this does not look like something that can be addressed in the codebase. Could you please close this issue if you agree? If you think there is a code change needed after all, please describe what should change.