CVE-2025-37731Medium· 6.8▾ SunlitImproper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certifica…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 37.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.
elasticsearch >= 7.0.0, <= 7.17.29elasticsearch >= 8.0.0, < 8.19.8elasticsearch >= 9.0.0, < 9.1.8elasticsearch >= 9.2.0, < 9.2.2Upgrade past the affected range:
elasticsearch 9.2.2Affected packages:
org.elasticsearch.plugin:x-pack-security >= 7.0.0-alpha1, < 8.19.8org.elasticsearch.plugin:x-pack-security >= 9.0.0-beta1, < 9.1.8org.elasticsearch.plugin:x-pack-security >= 9.2.0, < 9.2.2org.elasticsearch.plugin:x-pack-core >= 7.0.0-alpha1, < 8.19.8org.elasticsearch.plugin:x-pack-core >= 9.0.0-beta1, < 9.1.8org.elasticsearch.plugin:x-pack-core >= 9.2.0, < 9.2.2Patched in:
org.elasticsearch.plugin:x-pack-security 8.19.8org.elasticsearch.plugin:x-pack-security 9.1.8org.elasticsearch.plugin:x-pack-security 9.2.2org.elasticsearch.plugin:x-pack-core 8.19.8org.elasticsearch.plugin:x-pack-core 9.1.8org.elasticsearch.plugin:x-pack-core 9.2.2Connected by shared product, vendor, weakness, or advisory.
CVE-2025-37727Medium· 5.7Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/opera…
CVE-2026-103006Medium· 6.5Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API
CVE-2026-103008Medium· 6.5Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth
CVE-2026-103009High· 7.1Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier
CVE-2026-102408Medium· 4.3Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492)
CVE-2026-103005Medium· 6.5Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130)