CVE-2025-37731: Elasticsearch PKI realm authentication bypass via crafted client certificates

CVE-2025-37731 · Severity: medium · CVSS 6.8 · Published 2025-12-15

Elasticsearch's PKI (Public Key Infrastructure) realm authentication can be bypassed using specially crafted client certificates signed by a legitimate Certificate Authority. An attacker with a valid CA-signed certificate could impersonate legitimate users and gain unauthorized access to Elasticsearch clusters. This compromises data confidentiality and integrity, potentially exposing sensitive search indexes and documents.

Technologies: Elasticsearch. Vendors: Elastic, Maven.

Quick answers

Is CVE-2025-37731 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-37731 being exploited in the wild.
How severe is CVE-2025-37731?
Medium severity, with a CVSS score of 6.8, published 15 December 2025.
Which products and versions are affected?
Elasticsearch 7.0.0-alpha1 through 8.19.7, 9.0.0-beta1 through 9.1.7, 9.2.0 through 9.2.1; org.elasticsearch.plugin:x-pack-core (Maven) ECOSYSTEM:introduced=7.0.0-alpha1,fixed=8.19.8; org.elasticsearch.plugin:x-pack-security (Maven) ECOSYSTEM:introduced=7.0.0-alpha1,fixed=8.19.8.
Is there a fix for CVE-2025-37731?
Yes. org.elasticsearch.plugin:x-pack-core (Maven): upgrade to 8.19.8 or later; org.elasticsearch.plugin:x-pack-security (Maven): upgrade to 8.19.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-37731 attacked?
It is attacked over the network.
Am I affected by CVE-2025-37731?
Check whether you run Elasticsearch, org.elasticsearch.plugin:x-pack-core (Maven) or org.elasticsearch.plugin:x-pack-security (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.elasticsearch.plugin:x-pack-core (Maven): upgrade to 8.19.8 or later
    # set org.elasticsearch.plugin:x-pack-core to 8.19.8 in your pom.xml or build.gradle
  • org.elasticsearch.plugin:x-pack-security (Maven): upgrade to 8.19.8 or later
    # set org.elasticsearch.plugin:x-pack-security to 8.19.8 in your pom.xml or build.gradle

Technical details

The vulnerability is rooted in improper authentication and certificate validation (CWE-287, CWE-295) in the PKI realm component of Elasticsearch. The flaw allows an attacker to craft malicious client certificates that bypass identity verification checks, leading to user impersonation. Attack requires network access to the Elasticsearch instance, low-level privileges (an existing authenticated connection or ability to present a CA-signed certificate), and no user interaction. An attacker can read and modify data within Elasticsearch by assuming the identity of legitimate users. Patches are available in versions 8.19.8, 9.1.8, and 9.2.2.

Affected products

  • Elastic Elasticsearch 7.0.0-alpha1 through 8.19.7, 9.0.0-beta1 through 9.1.7, 9.2.0 through 9.2.1

Identifiers

  • CVE-2025-37731
  • GHSA-m9gh-789g-q5pv

Timeline

  • 2025-12-15: disclosed: Published to GitHub Advisory Database and NVD
  • 2025-12-15: patched: Patches released in versions 8.19.8, 9.1.8, and 9.2.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.