# Elastic Cloud on Kubernetes 1.1.0 security update **URL:** \ **Category:** Security Announcements\ **Created:** [April 28, 2020, 5:23pm UTC](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-1-1-0-security-update/230221 "2020-04-28T17:23:34Z")\ **Posts on this page:** 1\ **Showing post:** 1
**Author:** ![joshbressers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joshbressers/32/42332_2.png) [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Post date:** [April 28, 2020, 5:23pm UTC](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-1-1-0-security-update/230221/1 "2020-04-28T17:23:35Z")
**Elastic Cloud on Kubernetes insecure password generation (ESA-2020-03)** Elastic Cloud on Kubernetes (ECK) versions prior to 1.1.0 generate passwords using a weak random number generator. If an attacker is able to determine when the current Elastic Stack cluster was deployed they may be able to more easily brute force the Elasticsearch credentials generated by ECK. **Affected Versions** ECK 1.0.0 and 1.0.1 **Solutions and Mitigations:** All Elastic Cloud on Kubernetes users should upgrade to version 1.1.0. Instructions for applying this update can be found [here](https://www.elastic.co/guide/en/cloud-on-k8s/1.1/k8s-upgrading-eck.html). There is no workaround for this issue. This issue affects the default auto-generated credentials for a cluster. Clusters where the auto-generated Elasticsearch credentials have been changed do not need to take any actions. Once ECK is upgraded to version 1.1.0 the auto-generated credentials should be rotated using the instructions found [here](https://www.elastic.co/guide/en/cloud-on-k8s/1.1/k8s-rotate-credentials.html). **CVSSv3: 7.5 - AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H** **CVE ID: [CVE-2020-7010](https://nvd.nist.gov/vuln/detail/CVE-2019-7010)** --- _[View the full topic](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-1-1-0-security-update/230221)._