# CVE-2026-115714: Elastic Docker images certificate validation flaw in OS bundle

Source: https://junglewise.ai/threats/cve-2026-115714-improper-certificate-validation-cwe-295-in-the-operating-system  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-115714 · Severity: high · CVSS 7.4 · Published 2026-11-03

Multiple Elastic data collection and management products shipped in Docker images contain an outdated operating system certificate bundle that includes compromised root certificate authorities from eMudhra. An attacker positioned between the application and remote services could impersonate legitimate servers and intercept or modify sensitive data transmitted over TLS connections, potentially leading to credential theft, data breaches, or configuration tampering.

Technologies: [Elastic Apm Server](https://junglewise.ai/threats/technologies/apm-server). Vendors: [Elastic](https://junglewise.ai/threats/vendors/elastic).

## Quick answers

**Is CVE-2026-115714 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115714 being exploited in the wild.

**How severe is CVE-2026-115714?** High severity, with a CVSS score of 7.4, published 3 November 2026.

**Which products and versions are affected?** Elastic Apm Server 8.0.0 to 8.19.23; 9.0.0 to 9.4.8; 9.5.0 to 9.5.5; Elastic Auditbeat 8.0.0 to 8.19.23; 9.0.0 to 9.4.8; 9.5.0 to 9.5.5; Elastic connectors 8.0.0 to 8.19.23; 9.0.0 to 9.4.8; 9.5.0 to 9.5.5; Elastic Maps Server 8.0.0 to 8.19.23; 9.0.0 to 9.4.8; 9.5.0 to 9.5.5; and 7 more.

**Is there a fix for CVE-2026-115714?** Yes: fixed in APM Server 8.19.24, 9.4.9, 9.5.6; Auditbeat 8.19.24, 9.4.9, 9.5.6; Filebeat 8.19.24, 9.4.9, 9.5.6; Heartbeat 8.19.24, 9.4.9, 9.5.6; Metricbeat 8.19.24, 9.4.9, 9.5.6; Packetbeat 8.19.24, 9.4.9, 9.5.6; Elastic Agent 8.19.24, 9.4.9, 9.5.6; Logstash 8.19.24, 9.4.9, 9.5.6; Elastic connectors 8.19.24, 9.4.9, 9.5.6; Universal Profiling 8.19.24, 9.4.9, 9.5.6; Elastic Maps Server 8.19.24, 9.4.9, 9.5.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115714 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-115714?** Check whether you run Elastic Apm Server, Elastic Auditbeat, Elastic connectors or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in APM Server 8.19.24, 9.4.9, 9.5.6; Auditbeat 8.19.24, 9.4.9, 9.5.6; Filebeat 8.19.24, 9.4.9, 9.5.6; Heartbeat 8.19.24, 9.4.9, 9.5.6; Metricbeat 8.19.24, 9.4.9, 9.5.6; Packetbeat 8.19.24, 9.4.9, 9.5.6; Elastic Agent 8.19.24, 9.4.9, 9.5.6; Logstash 8.19.24, 9.4.9, 9.5.6; Elastic connectors 8.19.24, 9.4.9, 9.5.6; Universal Profiling 8.19.24, 9.4.9, 9.5.6; Elastic Maps Server 8.19.24, 9.4.9, 9.5.6

## Technical details

The Docker images bundle an outdated OS certificate store containing eight compromised eMudhra intermediate certificate authorities whose private keys have been exposed. An attacker with network access between the product and remote endpoints can forge valid certificates for any hostname and perform man-in-the-middle attacks on TLS connections that rely on the default OS trust store (CWE-295, CWE-1395). This affects only Docker images; host package and archive installations use the host OS trust store and are not vulnerable.

## Affected products

- Elastic APM Server 8.0.0 to 8.19.23; 9.0.0 to 9.4.8; 9.5.0 to 9.5.5
- Elastic Auditbeat 8.0.0 to 8.19.23; 9.0.0 to 9.4.8; 9.5.0 to 9.5.5
- Elastic Filebeat 8.0.0 to 8.19.23; 9.0.0 to 9.4.8; 9.5.0 to 9.5.5
- Elastic Heartbeat 8.0.0 to 8.19.23; 9.0.0 to 9.4.8; 9.5.0 to 9.5.5
- Elastic Metricbeat 8.0.0 to 8.19.23; 9.0.0 to 9.4.8; 9.5.0 to 9.5.5
- Elastic Packetbeat 8.0.0 to 8.19.23; 9.0.0 to 9.4.8; 9.5.0 to 9.5.5
- Elastic Elastic Agent 8.0.0 to 8.19.23; 9.0.0 to 9.4.8; 9.5.0 to 9.5.5
- Elastic Logstash 8.0.0 to 8.19.23; 9.0.0 to 9.4.8; 9.5.0 to 9.5.5
- Elastic Elastic connectors 8.0.0 to 8.19.23; 9.0.0 to 9.4.8; 9.5.0 to 9.5.5
- Elastic Universal Profiling 8.0.0 to 8.19.23; 9.0.0 to 9.4.8; 9.5.0 to 9.5.5
- Elastic Elastic Maps Server 8.0.0 to 8.19.23; 9.0.0 to 9.4.8; 9.5.0 to 9.5.5

## Timeline

- 2026-11-03: disclosed

## References

- [https://discuss.elastic.co/t/multiple-elastic-docker-images-8-19-24-9-4-9-9-5-6-security-update-esa-2026-237/391374](https://discuss.elastic.co/t/multiple-elastic-docker-images-8-19-24-9-4-9-9-5-6-security-update-esa-2026-237/391374)

## Related threats

- [Elastic APM Server denial of service via oversized OTLP payloads](https://junglewise.ai/threats/cve-2026-115716-allocation-of-resources-without-limits-or-throttling-cwe-770-in)
- [Elastic Packetbeat NULL pointer dereference in AMQP parser](https://junglewise.ai/threats/cve-2026-115297-null-pointer-dereference-cwe-476-in-the-amqp-protocol-parser-in)
- [Elastic APM Server configuration cache collision information disclosure](https://junglewise.ai/threats/cve-2026-115289-use-of-multiple-resources-with-duplicate-identifier-cwe-694-in)
- [Elastic APM Server improper handling of compressed data denial of service](https://junglewise.ai/threats/cve-2026-78594-elastic-apm-server-improper-handling-of-compressed-data-denial-of)
- [Elastic Filebeat denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-78588-elastic-filebeat-denial-of-service-via-resource-exhaustion)