CVE-2025-37731

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-12-15

Last updated on: 2025-12-18

Assigner: Elastic

Description

Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-15

Last Modified

2025-12-18

Generated

2026-07-06

AI Q&A

2025-12-15

EPSS Evaluated

2026-07-05

NVD

CVE-2025-37731

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	From 7.0.0 (inc) to 7.17.29 (inc)
elastic	elasticsearch	From 8.0.0 (inc) to 8.19.8 (exc)
elastic	elasticsearch	From 9.0.0 (inc) to 9.1.8 (exc)
elastic	elasticsearch	From 9.2.0 (inc) to 9.2.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-NVD-CWE-noinfo
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

CVE-2025-37731 is an improper authentication vulnerability in the Elasticsearch PKI realm. It allows an attacker to impersonate users by using specially crafted client certificates. However, the attacker must have a malicious client certificate that is signed by a legitimate, trusted Certificate Authority to exploit this issue. [1]

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade Elasticsearch to a fixed version: 8.19.8, 9.1.8, or 9.2.2. There are no workarounds available for users unable to upgrade. [1]

Impact Analysis

This vulnerability can lead to user impersonation, meaning an attacker could gain unauthorized access to Elasticsearch systems by presenting a crafted client certificate. This could compromise the confidentiality and integrity of data within Elasticsearch, potentially allowing unauthorized data access or manipulation. [1]

Compliance Impact

The provided resources do not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2025-37731. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70