CVE-2026-115714: Improper Certificate Validation in Elastic Docker Images Leading to Interception of TLS Connections
Improper Certificate Validation (CWE-295) in the operating system certificate bundle shipped in the Docker images of APM Server; Auditbeat, Filebeat, Heartbeat, Metricbeat and Packetbeat; Elastic Agent, including Fleet Server and Cloudbeat; Logstash, for TLS connections that use the operating system certificate bundle; Elastic connectors; Universal Profiling (host agent, collector and symbolizer); and Elastic Maps Server. This certificate bundle, a dependency of these products (Dependency on Vulnerable Third-Party Component, CWE-1395), could allow an attacker to intercept or modify TLS-protected traffic via Signature Spoofing by Key Theft (CAPEC-474). The certificate bundle includes root certificate authorities that signed eight eMudhra intermediate certificate authorities whose private keys are compromised. Anyone with these keys can issue a certificate for any host name that these products accept as trusted. Exploitation requires an attacker in a network position between the product and the remote party, who presents a certificate issued with one of the compromised keys.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects the listed Elastic Docker images when their TLS connections use the operating system certificate bundle shipped in those images. Products using a different trust store are not identified as affected by the provided information.
What must an attacker be able to do to exploit it?
The attacker must be in a network position between the affected product and its remote peer. They must present a certificate for a trusted host name that was issued using one of the compromised eMudhra intermediate CA private keys.
What could an attacker accomplish if exploitation succeeds?
An attacker could intercept or modify TLS-protected traffic handled by the affected products. The impact is limited to TLS connections that rely on the affected operating system certificate bundle.