{"id":"CVE-2026-115714","kind":"vulnerability","aliases":["CVE-2026-115714"],"related":[],"title":"Elastic Stack Docker images trust certificates from compromised eMudhra intermediate authorities","description":"Improper Certificate Validation (CWE-295) in the operating system certificate bundle shipped in the Docker images of APM Server; Auditbeat, Filebeat, Heartbeat, Metricbeat and Packetbeat; Elastic Agent, including Fleet Server and Cloudbeat; Logstash, for TLS connections that use the operating system certificate bundle; Elastic connectors; Universal Profiling (host agent, collector and symbolizer); and Elastic Maps Server. This certificate bundle, a dependency of these products (Dependency on Vulnerable Third-Party Component, CWE-1395), could allow an attacker to intercept or modify TLS-protected traffic via Signature Spoofing by Key Theft (CAPEC-474). The certificate bundle includes root certificate authorities that signed eight eMudhra intermediate certificate authorities whose private keys are compromised. Anyone with these keys can issue a certificate for any host name that these products accept as trusted. Exploitation requires an attacker in a network position between the product and the remote party, who presents a certificate issued with one of the compromised keys.","summary":"The operating system certificate bundle shipped in several Elastic Stack Docker images includes root authorities that signed eight eMudhra intermediate certificate authorities whose private keys are compromised. An attacker holding those keys can issue certificates for any host name these products trust and intercept or modify TLS traffic from a network position between the product and the remote party.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Elastic Docker images (APM Server, Beats, Elastic Agent, Logstash, connectors, Universal Profiling, Maps Server)","fixed":["8.19.24","9.4.9","9.5.6"],"affected":">= 8.0.0, <= 8.19.23; >= 9.0.0, <= 9.4.8; >= 9.5.0, <= 9.5.5","ecosystem":"docker"}],"ecosystems":[],"tags":["apm-server","beats","docker","elastic-agent","elastic-stack","emudhra","infrastructure","logstash","self-hosted"],"not_affected_if":["custom-trust-store","no-outbound-tls","package-install","pinned-certificates"],"how_to_check":"- Applies only to the official Elastic Docker images of APM Server, Auditbeat/Filebeat/Heartbeat/Metricbeat/Packetbeat, Elastic Agent (incl. Fleet Server, Cloudbeat), Logstash, Elastic connectors, Universal Profiling and Elastic Maps Server. Check the image tag: affected are 8.0.0-8.19.23, 9.0.0-9.4.8, 9.5.0-9.5.5.\n- Affected TLS connections are those using the image's default OS trust store, i.e. no specific CAs set (for example ssl.certificate_authorities not set).\n- Also check the bundle for eMudhra roots inside the image, for example by inspecting /etc/ssl/certs/ca-certificates.crt (our suggestion, not from Elastic's page).\n- Package or archive installs use the host OS trust store and are not covered by this advisory: apply your OS vendor's certificate update. Elasticsearch and Kibana images are covered separately (ESA-2026-227, ESA-2026-229).","fix":"Upgrade the official Elastic Docker images to 8.19.24, 9.4.9 or 9.5.6 (or a later release). These images update the OS certificate bundle and remove the affected eMudhra root CAs. Logstash fixed versions update both its OS and Java trust stores. Elastic states there are no workarounds if you cannot upgrade.","status":"open","published_at":"2026-11-03T17:17:56+00:00","first_seen_at":"2026-11-03T17:21:55+00:00","triaged_at":"2026-11-03T17:24:10+00:00","updated_at":"2026-11-03T17:26:07+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-03T17:24:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Elastic Stack Docker images trust certificates from compromised eMudhra intermediate authorities","impact":"high","summary":"The operating system certificate bundle shipped in several Elastic Stack Docker images includes root authorities that signed eight eMudhra intermediate certificate authorities whose private keys are compromised. An attacker holding those keys can issue certificates for any host name these products trust and intercept or modify TLS traffic from a network position between the product and the remote party.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["elastic-stack","docker","beats","elastic-agent","logstash","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker intercepts and modifies TLS traffic to trusted hosts","analyst_note":"Find the fixed Elastic product versions and the vendor's remediation guidance for the eMudhra bundle issue on Elastic's advisory page (NVD link in sources).","how_to_check":"- Check whether the Elastic product image or host uses the operating system certificate bundle for TLS connections (APM Server, Beats, Elastic Agent, Logstash, Elastic connectors, Universal Profiling, Elastic Maps Server).\n- Confirm the product version in use, for example with `elastic-agent version` or the Beat's `--version` flag.\n- Check for the eMudhra intermediate certificates in the bundle, for example with `trust list` on the host or by inspecting `/etc/ssl/certs/ca-certificates.crt` in the image.","plain_action":"","needs_analyst":true,"not_affected_if":["custom-trust-store","no-outbound-tls","pinned-certificates"],"who_is_affected":"Teams running Elastic Stack components from Docker images or containers that rely on the image's operating system certificate bundle for outbound TLS. Exposure requires an attacker in a network position between the product and the remote party who presents a certificate issued with a compromised key. Deployments that use only pinned certificates or a custom trust store not containing the affected roots are less exposed; the sources do not say which specific product versions are fixed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000832,"input_tokens":4398,"output_tokens":785,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed Elastic product versions and the vendor's remediation guidance for the eMudhra bundle issue on Elastic's advisory page (NVD link in sources).","search":"'-115714':14A,17A '-1395':180C '-2026':13A,16A '-295':112C '-474':200C 'accept':235C 'agent':25A,39B,134C,156C 'allow':182C 'anyon':220C 'apm':21A,33B,125C 'apm-serv':32B 'attack':77B,184C,241C 'auditbeat':127C 'author':11A,63B,70B,207C,214C 'beat':35B 'beats':23A 'bundl':53B,118C,150C,166C,203C 'capec':199C 'certif':6A,52B,69B,83B,109C,117C,149C,165C,202C,206C,213C,227C,256C 'cloudbeat':139C 'collector':157C 'compon':178C 'compromis':8A,75B,219C,262C 'connect':143C 'connector':152C 'connectors':27A 'could':181C 'cve':12A,15A 'cwe':111C,179C 'depend':168C,172C 'docker':3A,19A,36B,59B,122C 'eight':66B,210C 'elast':1A,38B,41B,57B,133C,151C,161C 'elastic':18A,24A 'elastic-ag':37B 'elastic-stack':40B 'emudhra':9A,43B,67B,211C 'exploit':238C 'filebeat':128C 'fleet':136C 'heartbeat':129C 'hold':78B 'host':48B,86B,155C,230C 'imag':4A,60B,123C 'images':20A 'improp':108C 'includ':61B,135C,204C 'infrastructur':44B 'intercept':92B,186C 'intermedi':10A,68B,212C 'issu':82B,225C,257C 'key':73B,80B,197C,217C,223C,263C 'logstash':26A,45B,140C 'map':162C 'maps':30A 'metricbeat':130C 'modifi':94B,188C 'name':87B,231C 'network':99B,244C 'one':259C 'oper':50B,115C,147C 'packetbeat':132C 'parti':107B,177C,252C 'posit':100B,245C 'present':254C 'privat':72B,216C 'product':89B,103B,171C,234C,248C 'profil':154C 'profiling':29A 'protect':191C 'remot':106B,251C 'requir':239C 'root':62B,205C 'self':47B 'self-host':46B 'server':22A,31A,34B,126C,137C,163C 'sever':56B 'ship':54B,119C 'sign':65B,209C 'signatur':194C 'spoof':195C 'stack':2A,42B,58B 'symbol':159C 'system':51B,116C,148C 'theft':198C 'third':176C 'third-parti':175C 'tls':95B,142C,190C 'tls-protect':189C 'traffic':96B,192C 'trust':5A,90B,237C 'univers':153C 'universal':28A 'use':145C 'valid':110C 'via':193C 'vulner':174C 'whose':71B,215C","nicknames":[],"mitigations":[],"who_affected":"Teams running the official Elastic Docker images of APM Server, the Beats, Elastic Agent, Logstash, Elastic connectors, Universal Profiling or Elastic Maps Server at versions up to 8.19.23, 9.4.8 or 9.5.5, whose outbound TLS connections use the image's default OS trust store (no specific certificate authorities configured). An attacker must sit on the network path and present a certificate issued with one of the compromised eMudhra intermediate keys. Package and archive installs are not covered by this advisory (they use the host trust store), and connections with explicit CA configuration can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-03T17:26:07Z","by":"analyst","doc":"https://discuss.elastic.co/t/multiple-elastic-docker-images-8-19-24-9-4-9-9-5-6-security-update-esa-2026-237/391374","run_id":1515},"products":{"at":"2026-11-03T17:26:07Z","by":"analyst","doc":"https://discuss.elastic.co/t/multiple-elastic-docker-images-8-19-24-9-4-9-9-5-6-security-update-esa-2026-237/391374","run_id":1515},"who_affected":{"at":"2026-11-03T17:26:07Z","by":"analyst","doc":"https://discuss.elastic.co/t/multiple-elastic-docker-images-8-19-24-9-4-9-9-5-6-security-update-esa-2026-237/391374","run_id":1515}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["dockerimagesapmserverbeatselasticagentlogstashconnectorsuniversalprofilingmapsserver","elasticdockerimagesapmserverbeatselasticagentlogstashconnectorsuniversalprofilingmapsserver"],"ptokens":["agent","apm","beats","connectors","docker","elastic","images","logstash","maps","profiling","server","universal"],"labels":["apmserver","beats","docker","elasticagent","elasticstack","emudhra","high","infrastructure","logstash","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-03T17:17:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security@elastic.co","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115714","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115714","severity":null,"published_at":"2026-11-03T17:17:56+00:00","modified_at":"2026-11-03T17:17:56+00:00","first_seen_at":"2026-11-03T17:21:55+00:00","fetched_at":"2026-11-03T17:21:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115714:1515","url":null,"severity":null,"published_at":"2026-11-03T17:26:07+00:00","modified_at":"2026-11-03T17:26:07+00:00","first_seen_at":"2026-11-03T17:26:07+00:00","fetched_at":"2026-11-03T17:26:07+00:00","note":"Read Elastic ESA-2026-237 (primary): fixed 8.19.24/9.4.9/9.5.6, no workarounds, Docker images only; packages/archives not affected. No exploitation or PoC claimed. how_to_check not verified (trust-store command is ours)."}],"documents":[{"id":59270,"url":"https://discuss.elastic.co/t/multiple-elastic-docker-images-8-19-24-9-4-9-9-5-6-security-update-esa-2026-237/391374","title":"Multiple Elastic Docker images 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-237)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}