---
id: "CVE-2026-115714"
kind: "vulnerability"
aliases: ["CVE-2026-115714"]
title: "Elastic Stack Docker images trust certificates from compromised eMudhra intermediate authorities"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Elastic Docker images (APM Server, Beats, Elastic Agent, Logstash, connectors, Universal Profiling, Maps Server)", "fixed": ["8.19.24", "9.4.9", "9.5.6"], "affected": ">= 8.0.0, <= 8.19.23; >= 9.0.0, <= 9.4.8; >= 9.5.0, <= 9.5.5", "ecosystem": "docker"}]
ecosystems: []
tags: ["apm-server", "beats", "docker", "elastic-agent", "elastic-stack", "emudhra", "infrastructure", "logstash", "self-hosted"]
not_affected_if: ["custom-trust-store", "no-outbound-tls", "package-install", "pinned-certificates"]
published_at: "2026-11-03T17:17:56+00:00"
first_seen_at: "2026-11-03T17:21:55+00:00"
updated_at: "2026-11-03T17:26:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115714", "first_seen_at": "2026-11-03T17:21:55+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T17:26:07+00:00"}]
---

# Elastic Stack Docker images trust certificates from compromised eMudhra intermediate authorities

The operating system certificate bundle shipped in several Elastic Stack Docker images includes root authorities that signed eight eMudhra intermediate certificate authorities whose private keys are compromised. An attacker holding those keys can issue certificates for any host name these products trust and intercept or modify TLS traffic from a network position between the product and the remote party.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- docker:Elastic Docker images (APM Server, Beats, Elastic Agent, Logstash, connectors, Universal Profiling, Maps Server) affected >= 8.0.0, <= 8.19.23; >= 9.0.0, <= 9.4.8; >= 9.5.0, <= 9.5.5 fixed 8.19.24, 9.4.9, 9.5.6

## How to check

- Applies only to the official Elastic Docker images of APM Server, Auditbeat/Filebeat/Heartbeat/Metricbeat/Packetbeat, Elastic Agent (incl. Fleet Server, Cloudbeat), Logstash, Elastic connectors, Universal Profiling and Elastic Maps Server. Check the image tag: affected are 8.0.0-8.19.23, 9.0.0-9.4.8, 9.5.0-9.5.5.
- Affected TLS connections are those using the image's default OS trust store, i.e. no specific CAs set (for example ssl.certificate_authorities not set).
- Also check the bundle for eMudhra roots inside the image, for example by inspecting /etc/ssl/certs/ca-certificates.crt (our suggestion, not from Elastic's page).
- Package or archive installs use the host OS trust store and are not covered by this advisory: apply your OS vendor's certificate update. Elasticsearch and Kibana images are covered separately (ESA-2026-227, ESA-2026-229).

## Fix

Upgrade the official Elastic Docker images to 8.19.24, 9.4.9 or 9.5.6 (or a later release). These images update the OS certificate bundle and remove the affected eMudhra root CAs. Logstash fixed versions update both its OS and Java trust stores. Elastic states there are no workarounds if you cannot upgrade.

## Timeline

- 2026-11-03T17:21:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115714
- 2026-11-03T17:26:07+00:00 analyst — Read Elastic ESA-2026-237 (primary): fixed 8.19.24/9.4.9/9.5.6, no workarounds, Docker images only; packages/archives not affected. No exploitation or PoC claimed. how_to_check not verified (trust-store command is ours).

## Documents

- [advisory] Multiple Elastic Docker images 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-237) https://discuss.elastic.co/t/multiple-elastic-docker-images-8-19-24-9-4-9-9-5-6-security-update-esa-2026-237/391374

## From the sources

Improper Certificate Validation (CWE-295) in the operating system certificate bundle shipped in the Docker images of APM Server; Auditbeat, Filebeat, Heartbeat, Metricbeat and Packetbeat; Elastic Agent, including Fleet Server and Cloudbeat; Logstash, for TLS connections that use the operating system certificate bundle; Elastic connectors; Universal Profiling (host agent, collector and symbolizer); and Elastic Maps Server. This certificate bundle, a dependency of these products (Dependency on Vulnerable Third-Party Component, CWE-1395), could allow an attacker to intercept or modify TLS-protected traffic via Signature Spoofing by Key Theft (CAPEC-474). The certificate bundle includes root certificate authorities that signed eight eMudhra intermediate certificate authorities whose private keys are compromised. Anyone with these keys can issue a certificate for any host name that these products accept as trusted. Exploitation requires an attacker in a network position between the product and the remote party, who presents a certificate issued with one of the compromised keys.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_