---
id: CVE-2025-37731
title: >-
  Improper Authentication in Elasticsearch PKI realm can lead to user
  impersonation via specially crafted client certificates
summary: >-
  Improper Authentication in Elasticsearch PKI realm can lead to user
  impersonation via specially crafted client certificates. A malicious actor
  would need to have such a crafted client certificate signed by a legitimate,
  trusted Certifica…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-287
  - CWE-295
vendor: elastic
product: elasticsearch
affected:
  - 'elasticsearch >= 7.0.0, <= 7.17.29'
  - 'elasticsearch >= 8.0.0, < 8.19.8'
  - 'elasticsearch >= 9.0.0, < 9.1.8'
  - 'elasticsearch >= 9.2.0, < 9.2.2'
patched:
  - elasticsearch 9.2.2
published: '2025-12-15'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T19:10:00.160'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-37731'
references:
  - url: >-
      https://discuss.elastic.co/t/elasticsearch-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-27/384063
    label: security@elastic.co
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-37731'
  - url: >-
      https://github.com/elastic/elasticsearch/commit/cd97b8566bf56e628070021300784cb9cee0286f
  - url: >-
      https://github.com/elastic/elasticsearch/commit/d8a408da79f214395845d99d241e832077045983
  - url: >-
      https://github.com/elastic/elasticsearch/commit/e519fe4c51a3c887675eb7daea2f914738847f23
  - url: 'https://github.com/advisories/GHSA-m9gh-789g-q5pv'
tags:
  - nvd
  - ghsa
  - maven
epss: 0.00192
epssPercentile: 0.08737
aliases:
  - GHSA-m9gh-789g-q5pv
ecosystem: maven
ingestedAt: '2026-09-25T18:14:20.398Z'
---

## Overview

Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.

## Affected

- `elasticsearch >= 7.0.0, <= 7.17.29`
- `elasticsearch >= 8.0.0, < 8.19.8`
- `elasticsearch >= 9.0.0, < 9.1.8`
- `elasticsearch >= 9.2.0, < 9.2.2`

## Remediation

Upgrade past the affected range:

- `elasticsearch 9.2.2`

## Package advisory (CVE-2025-37731)

Affected packages:

- `org.elasticsearch.plugin:x-pack-security >= 7.0.0-alpha1, < 8.19.8`
- `org.elasticsearch.plugin:x-pack-security >= 9.0.0-beta1, < 9.1.8`
- `org.elasticsearch.plugin:x-pack-security >= 9.2.0, < 9.2.2`
- `org.elasticsearch.plugin:x-pack-core >= 7.0.0-alpha1, < 8.19.8`
- `org.elasticsearch.plugin:x-pack-core >= 9.0.0-beta1, < 9.1.8`
- `org.elasticsearch.plugin:x-pack-core >= 9.2.0, < 9.2.2`

Patched in:

- `org.elasticsearch.plugin:x-pack-security 8.19.8`
- `org.elasticsearch.plugin:x-pack-security 9.1.8`
- `org.elasticsearch.plugin:x-pack-security 9.2.2`
- `org.elasticsearch.plugin:x-pack-core 8.19.8`
- `org.elasticsearch.plugin:x-pack-core 9.1.8`
- `org.elasticsearch.plugin:x-pack-core 9.2.2`

Source: https://github.com/advisories/GHSA-m9gh-789g-q5pv