medium6.8
CVE-2025-37731
Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User Impersonation Through Crafted Client Certificates
Impact
Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.elasticsearch.plugin:x-pack-security | >= 7.0.0-alpha1, < 8.19.8 | 8.19.8 |
| maven | org.elasticsearch.plugin:x-pack-core | >= 7.0.0-alpha1, < 8.19.8 | 8.19.8 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Elastic | Elasticsearch | from 7.0.0 through 7.17.29 from 8.0.0 before 8.19.8 from 9.0.0 before 9.1.8 from 9.2.0 before 9.2.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://discuss.elastic.co/t/elasticsearch-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-27/384063
- https://github.com/advisories/GHSA-m9gh-789g-q5pv
- https://nvd.nist.gov/vuln/detail/CVE-2025-37731
- https://github.com/elastic/elasticsearch/commit/cd97b8566bf56e628070021300784cb9cee0286f
- https://github.com/elastic/elasticsearch/commit/d8a408da79f214395845d99d241e832077045983
- https://github.com/elastic/elasticsearch/commit/e519fe4c51a3c887675eb7daea2f914738847f23