Which version of Elasticsearch are you using? If this is not the latest one, have you checked whether the issue still persists in the latest version?
Also note that security issues are not discussed publicly in these forums.Please look here for further details and a way to contact Elastic directly around this issue.