Read the docs
TI-2026-84425 Aliases CVE-2026-115714GHSA-qrp4-c626-6hw2

Improper certificate validation in Elastic Docker images

Priority LOW 34CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-295.

Summary

Elastic Docker images are affected in versions 8.0.0 through 8.19.23, 9.0.0 through 9.4.8 and 9.5.0 through 9.5.5. Their operating system certificate bundle includes root certificate authorities that signed eight eMudhra intermediate certificate authorities whose private keys are compromised, so certificates issued with those keys are accepted (CWE-295). An attacker positioned between a product and the remote party can present such a certificate to intercept or modify TLS traffic.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Improper Certificate Validation (CWE-295) in the operating system certificate bundle shipped in the Docker images of APM Server; Auditbeat, Filebeat, Heartbeat, Metricbeat and Packetbeat; Elastic Agent, including Fleet Server and Cloudbeat; Logstash, for TLS connections that use the operating system certificate bundle; Elastic connectors; Universal Profiling (host agent, collector and symbolizer); and Elastic Maps Server. This certificate bundle, a dependency of these products (Dependency on Vulnerable Third-Party Component, CWE-1395), could allow an attacker to intercept or modify TLS-protected traffic via Signature Spoofing by Key Theft (CAPEC-474). The certificate bundle includes root certificate authorities that signed eight eMudhra intermediate certificate authorities whose private keys are compromised. Anyone with these keys can issue a certificate for any host name that these products accept as trusted. Exploitation requires an attacker in a network position between the product and the remote party, who presents a certificate issued with one of the compromised keys.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00183 7th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ElasticElastic Docker images8.0.0 – 8.19.23; 9.0.0 – 9.4.8; 9.5.0 – 9.5.5—No fix listedCNA
  • Elastic Docker images VendorElastic Affected 8.0.0 – 8.19.23; 9.0.0 – 9.4.8; 9.5.0 – 9.5.5 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Elastic Docker images.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-115714
  2. 2026-11-03 CISA SSVC decision points changed
  3. 2026-11-03 Priority changed: MEDIUM → LOW
  4. 2026-11-03 Alias added: GHSA-qrp4-c626-6hw2

References

Other 1

  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2015-01295 The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-02491 The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which… KEVCVSS 3.1HIGH 8.1
  • TI-2018-12328 Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the… CVSS 3.0CRITICAL 9.8
  • TI-2023-15037 Elasticsearch StackOverflow vulnerability CVSS 3.1HIGH 7.5
  • TI-2021-05135 Information disclosure in Elasticsearch CVSS 3.1MEDIUM 6.5
See all 414 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences