rewindex

RewindexCVEsElastic Cloud

CVE-2026-115714: Improper Certificate Validation in Elastic Docker Images Leading to Interception of TLS Connections

High · CVSS 7.4 (CVSS 3.1)EPSS 0.18%, 8th percentilePublished Updated Assigner: elastic

Description

Improper Certificate Validation (CWE-295) in the operating system certificate bundle shipped in the Docker images of APM Server; Auditbeat, Filebeat, Heartbeat, Metricbeat and Packetbeat; Elastic Agent, including Fleet Server and Cloudbeat; Logstash, for TLS connections that use the operating system certificate bundle; Elastic connectors; Universal Profiling (host agent, collector and symbolizer); and Elastic Maps Server. This certificate bundle, a dependency of these products (Dependency on Vulnerable Third-Party Component, CWE-1395), could allow an attacker to intercept or modify TLS-protected traffic via Signature Spoofing by Key Theft (CAPEC-474). The certificate bundle includes root certificate authorities that signed eight eMudhra intermediate certificate authorities whose private keys are compromised. Anyone with these keys can issue a certificate for any host name that these products accept as trusted. Exploitation requires an attacker in a network position between the product and the remote party, who presents a certificate issued with one of the compromised keys.

Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N · CWE-295

Tracked companies

Elastic Cloud

Mapped from the CVE’s affected-product data, NVD CPE matches, vendor advisories or package feeds. A mapping means the vendor’s software is named, not that its hosted service was exposed.

Status incidents that name it

No tracked status incident names this CVE.

Affected vendors and products

Elastic: Elastic Docker images

References

All CVEsMarkdownJSON