Executive brief
Elasticsearch's PKI (Public Key Infrastructure) realm authentication can be bypassed using specially crafted client certificates signed by a legitimate Certificate Authority. An attacker with a valid CA-signed certificate could impersonate legitimate users and gain unauthorized access to Elasticsearch clusters. This compromises data confidentiality and integrity, potentially exposing sensitive search indexes and documents.
Technical details
The vulnerability is rooted in improper authentication and certificate validation (CWE-287, CWE-295) in the PKI realm component of Elasticsearch. The flaw allows an attacker to craft malicious client certificates that bypass identity verification checks, leading to user impersonation. Attack requires network access to the Elasticsearch instance, low-level privileges (an existing authenticated connection or ability to present a CA-signed certificate), and no user interaction. An attacker can read and modify data within Elasticsearch by assuming the identity of legitimate users. Patches are available in versions 8.19.8, 9.1.8, and 9.2.2.
Affected products
- Elastic Elasticsearch 7.0.0-alpha1 through 8.19.7, 9.0.0-beta1 through 9.1.7, 9.2.0 through 9.2.1
Timeline
- 2025-12-15: disclosed: Published to GitHub Advisory Database and NVD
- 2025-12-15: patched: Patches released in versions 8.19.8, 9.1.8, and 9.2.2