Live › vulnerability › CVE-2026-115714
The operating system certificate bundle shipped in several Elastic Stack Docker images includes root authorities that signed eight eMudhra intermediate certificate authorities whose private keys are compromised. An attacker holding those keys can issue certificates for any host name these products trust and intercept or modify TLS traffic from a network position between the product and the remote party.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
Teams running the official Elastic Docker images of APM Server, the Beats, Elastic Agent, Logstash, Elastic connectors, Universal Profiling or Elastic Maps Server at versions up to 8.19.23, 9.4.8 or 9.5.5, whose outbound TLS connections use the image's default OS trust store (no specific certificate authorities configured). An attacker must sit on the network path and present a certificate issued with one of the compromised eMudhra intermediate keys. Package and archive installs are not covered by this advisory (they use the host trust store), and connections with explicit CA configuration can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Elastic Docker images (APM Server, Beats, Elastic Agent, Logstash, connectors, Universal Profiling, Maps Server) | docker | >= 8.0.0, <= 8.19.23; >= 9.0.0, <= 9.4.8; >= 9.5.0, <= 9.5.5 | 8.19.24, 9.4.9, 9.5.6 |
8.19.24, 9.4.9 or 9.5.6 (or a later release)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Certificate Validation (CWE-295) in the operating system certificate bundle shipped in the Docker images of APM Server; Auditbeat, Filebeat, Heartbeat, Metricbeat and Packetbeat; Elastic Agent, including Fleet Server and Cloudbeat; Logstash, for TLS connections that use the operating system certificate bundle; Elastic connectors; Universal Profiling (host agent, collector and symbolizer); and Elastic Maps Server. This certificate bundle, a dependency of these products (Dependency on Vulnerable Third-Party Component, CWE-1395), could allow an attacker to intercept or modify TLS-protected traffic via Signature Spoofing by Key Theft (CAPEC-474). The certificate bundle includes root certificate authorities that signed eight eMudhra intermediate certificate authorities whose private keys are compromised. Anyone with these keys can issue a certificate for any host name that these products accept as trusted. Exploitation requires an attacker in a network position between the product and the remote party, who presents a certificate issued with one of the compromised keys.
This page as .md · .json · in your agent: get_signal("CVE-2026-115714")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.