Beats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issue
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-295.
Summary
It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether the server certificate is valid for the target IP address; however, certificate signature validation is still performed. More specifically, when the client is configured to connect to an IP address (instead of a hostname) it does not validate the server certificate's IP SAN values against that IP address and certificate validation fails, and therefore the connection is not blocked as expected.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Elastic | Beats | 8.0.0, 8.9.2 | — | No fix listed | CNA |
| Elastic | Elastic Agent | 8.0.0, 8.9.2 | — | No fix listed | CNA |
| Elastic | APM Server | 8.0.0, 8.9.2 | — | No fix listed | CNA |
| Elastic | Fleet Server | 8.0.0, 8.9.2 | — | No fix listed | CNA |
- Beats VendorElastic Affected 8.0.0, 8.9.2 Fixed in — No fix listed CNA
- Elastic Agent VendorElastic Affected 8.0.0, 8.9.2 Fixed in — No fix listed CNA
- APM Server VendorElastic Affected 8.0.0, 8.9.2 Fixed in — No fix listed CNA
- Fleet Server VendorElastic Affected 8.0.0, 8.9.2 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:elastic:elastic_beats:*:*:*:*:*:*:*:* | 8.0.0 – 8.9.2 | Vulnerable | Elastic |
| cpe:2.3:a:elastic:elastic_agent:*:*:*:*:*:*:*:* | 8.0.0 – 8.9.2 | Vulnerable | Elastic |
| cpe:2.3:a:elastic:apm_server:*:*:*:*:*:*:*:* | 8.0.0 – 8.9.2 | Vulnerable | Elastic |
| cpe:2.3:a:elastic:elastic_fleet_server:*:*:*:*:*:*:*:* | 8.0.0 – 8.9.2 | Vulnerable | Elastic |
- cpe:2.3:a:elastic:elastic_beats:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.9.2 Vulnerable ·Elastic
- cpe:2.3:a:elastic:elastic_agent:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.9.2 Vulnerable ·Elastic
- cpe:2.3:a:elastic:apm_server:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.9.2 Vulnerable ·Elastic
- cpe:2.3:a:elastic:elastic_fleet_server:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.9.2 Vulnerable ·Elastic
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-31421
- 2026-10-03 Alias added: GHSA-4x46-8gg7-f9vx
References
More Elastic Apm Server vulnerabilities
- TI-2024-15495 APM Server Insertion of Sensitive Information into Log File CVSS 3.1HIGH 7.5
- TI-2024-24801 APM Server Insertion of Sensitive Information into Log File CVSS 3.1MEDIUM 6.5
- TI-2026-54643 Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service CVSS 3.1MEDIUM 4.9
Sources
- CVE-2023-31421 · CVE Program
- CVE-2023-31421 · NVD
- FIRST EPSS
- GHSA-4x46-8gg7-f9vx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences