{"id":"CVE-2025-37731","title":"Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates","summary":"Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certifica…","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-287","CWE-295"],"vendor":"elastic","product":"elasticsearch","affected":["elasticsearch >= 7.0.0, <= 7.17.29","elasticsearch >= 8.0.0, < 8.19.8","elasticsearch >= 9.0.0, < 9.1.8","elasticsearch >= 9.2.0, < 9.2.2"],"patched":["elasticsearch 9.2.2"],"published":"2025-12-15","updated":"2026-10-07","sourceUpdated":"2026-10-07T19:10:00.160","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-37731","references":[{"url":"https://discuss.elastic.co/t/elasticsearch-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-27/384063","label":"security@elastic.co"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37731"},{"url":"https://github.com/elastic/elasticsearch/commit/cd97b8566bf56e628070021300784cb9cee0286f"},{"url":"https://github.com/elastic/elasticsearch/commit/d8a408da79f214395845d99d241e832077045983"},{"url":"https://github.com/elastic/elasticsearch/commit/e519fe4c51a3c887675eb7daea2f914738847f23"},{"url":"https://github.com/advisories/GHSA-m9gh-789g-q5pv"}],"tags":["nvd","ghsa","maven"],"epss":0.00192,"epssPercentile":0.08737,"aliases":["GHSA-m9gh-789g-q5pv"],"ecosystem":"maven","ingestedAt":"2026-09-25T18:14:20.398Z","slug":"CVE-2025-37731","body":"## Overview\n\nImproper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.\n\n## Affected\n\n- `elasticsearch >= 7.0.0, <= 7.17.29`\n- `elasticsearch >= 8.0.0, < 8.19.8`\n- `elasticsearch >= 9.0.0, < 9.1.8`\n- `elasticsearch >= 9.2.0, < 9.2.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `elasticsearch 9.2.2`\n\n## Package advisory (CVE-2025-37731)\n\nAffected packages:\n\n- `org.elasticsearch.plugin:x-pack-security >= 7.0.0-alpha1, < 8.19.8`\n- `org.elasticsearch.plugin:x-pack-security >= 9.0.0-beta1, < 9.1.8`\n- `org.elasticsearch.plugin:x-pack-security >= 9.2.0, < 9.2.2`\n- `org.elasticsearch.plugin:x-pack-core >= 7.0.0-alpha1, < 8.19.8`\n- `org.elasticsearch.plugin:x-pack-core >= 9.0.0-beta1, < 9.1.8`\n- `org.elasticsearch.plugin:x-pack-core >= 9.2.0, < 9.2.2`\n\nPatched in:\n\n- `org.elasticsearch.plugin:x-pack-security 8.19.8`\n- `org.elasticsearch.plugin:x-pack-security 9.1.8`\n- `org.elasticsearch.plugin:x-pack-security 9.2.2`\n- `org.elasticsearch.plugin:x-pack-core 8.19.8`\n- `org.elasticsearch.plugin:x-pack-core 9.1.8`\n- `org.elasticsearch.plugin:x-pack-core 9.2.2`\n\nSource: https://github.com/advisories/GHSA-m9gh-789g-q5pv","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}