What it is
Search/index engines like Elasticsearch or OpenSearch.
Why it is risky
An unauthenticated cluster on the internet exposes all indices to read/delete and can lead to script execution.
What to do
Enable the security plugin/auth and restrict HTTP (9200) and transport (9300) to internal networks.
Is it listening on your server?
Linux
ss -ltnp 'sport = :9300'Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.