CVE-2025-37731
High · 7.4CVSS
7.4
EPSS
0.2%
Published
Dec 15, 2025
CISA due date
—
The record
Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.elasticsearch:elasticsearch | 7.0.0-alpha1 | 8.19.8 |
| Maven | org.elasticsearch:elasticsearch | 9.0.0-beta1 | 9.1.8 |
| Maven | org.elasticsearch:elasticsearch | 9.2.0 | 9.2.2 |
| Bitnami | elasticsearch | 0 | 8.19.8 |
| Chainguard | camunda-8.8-compat | 0 | 8.8.8-r0 |
| Chainguard | camunda-zeebe-8.6-compat | 0 | 8.6.34-r1 |
| Chainguard | camunda-zeebe-8.7-compat | 0 | 8.7.21-r1 |
| Chainguard | camunda-zeebe-8.8-compat | 0 | 8.8.8-r1 |
| Chainguard | elasticsearch-8.17-config | 0 | 8.17.10-r15 |
| Chainguard | elasticsearch-8.18-config | 0 | 8.18.8-r2 |
| Chainguard | elasticsearch-9.0-config | 0 | 9.0.8-r2 |
| Chainguard | elasticsearch-fips-8.17-config | 0 | 8.17.10-r3 |
| Chainguard | elasticsearch-fips-8.18-config | 0 | 8.18.8-r3 |
| Chainguard | elasticsearch-fips-9.0-config | 0 | 9.0.8-r2 |
| Chainguard | ruby3.2-elasticsearch | 0 | 0 |
| Chainguard | ruby3.3-elasticsearch | 0 | 0 |
| Chainguard | ruby3.4-elasticsearch | 0 | 0 |
| Chainguard | ruby4.0-elasticsearch | 0 | 9.3.0-r0 |
| Chainguard | sonarqube | 0 | 25.12.0.117093-r1 |
| Chainguard | sonarqube-docker-compat | 0 | 25.12.0.117093-r1 |
| Chainguard | sonarqube-scripts | 0 | 25.12.0.117093-r1 |
| Wolfi | ruby3.2-elasticsearch | 0 | 0 |
| Wolfi | ruby3.3-elasticsearch | 0 | 0 |
| Wolfi | ruby3.4-elasticsearch | 0 | 0 |
| Wolfi | ruby4.0-elasticsearch | 0 | 9.3.0-r0 |
| Wolfi | sonarqube | 0 | 25.12.0.117093-r1 |
| Wolfi | sonarqube-docker-compat | 0 | 25.12.0.117093-r1 |
| Wolfi | sonarqube-scripts | 0 | 25.12.0.117093-r1 |
| maven | org.elasticsearch/elasticsearch | 7.0.0-alpha1 | 8.19.8 |
| maven | org.elasticsearch/elasticsearch | 9.0.0-beta1 | 9.1.8 |
| maven | org.elasticsearch/elasticsearch | 9.2.0 | 9.2.2 |
Related vulnerabilities
- CVE-2024-12539 Elasticsearch Incorrect Authorization vulnerability Also affects org.elasticsearch:elasticsearch
- CVE-2024-23444 It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is… Also affects org.elasticsearch:elasticsearch
- CVE-2023-49921 An issue was discovered by Elastic whereby Watcher search input logged the search query… Also affects org.elasticsearch:elasticsearch
- CVE-2024-37280 A flaw was discovered in Elasticsearch, affecting document ingestion when an index… Also affects org.elasticsearch:elasticsearch
- CVE-2024-23449 An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF… Also affects org.elasticsearch:elasticsearch
- CVE-2024-23451 Incorrect Authorization issue exists in the API key based security model for Remote… Also affects org.elasticsearch:elasticsearch
- CVE-2024-23450 A flaw was discovered in Elasticsearch, where processing a document in a deeply nested… Also affects org.elasticsearch:elasticsearch
- CVE-2023-46673 It was identified that malformed scripts used in the script processor of an Ingest… Also affects org.elasticsearch:elasticsearch