{"id":"CVE-2025-37731","aliases":["GHSA-m9gh-789g-q5pv"],"title":"Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User Impersonation Through Crafted Client Certificates","summary":"Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User Impersonation Through Crafted Client Certificates","severity":"medium","cvss":6.8,"cwe":["CWE-287","CWE-295"],"vendor":"elasticsearch","product":"org.elasticsearch.plugin:x-pack-security","ecosystem":"maven","affected":["org.elasticsearch.plugin:x-pack-security >= 7.0.0-alpha1, < 8.19.8","org.elasticsearch.plugin:x-pack-security >= 9.0.0-beta1, < 9.1.8","org.elasticsearch.plugin:x-pack-security >= 9.2.0, < 9.2.2","org.elasticsearch.plugin:x-pack-core >= 7.0.0-alpha1, < 8.19.8","org.elasticsearch.plugin:x-pack-core >= 9.0.0-beta1, < 9.1.8","org.elasticsearch.plugin:x-pack-core >= 9.2.0, < 9.2.2"],"patched":["org.elasticsearch.plugin:x-pack-security 8.19.8","org.elasticsearch.plugin:x-pack-security 9.1.8","org.elasticsearch.plugin:x-pack-security 9.2.2","org.elasticsearch.plugin:x-pack-core 8.19.8","org.elasticsearch.plugin:x-pack-core 9.1.8","org.elasticsearch.plugin:x-pack-core 9.2.2"],"published":"2025-12-15","updated":"2026-09-25","sourceUpdated":"2026-09-25T17:36:28Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-m9gh-789g-q5pv","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37731"},{"url":"https://discuss.elastic.co/t/elasticsearch-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-27/384063"},{"url":"https://github.com/elastic/elasticsearch/commit/cd97b8566bf56e628070021300784cb9cee0286f"},{"url":"https://github.com/elastic/elasticsearch/commit/d8a408da79f214395845d99d241e832077045983"},{"url":"https://github.com/elastic/elasticsearch/commit/e519fe4c51a3c887675eb7daea2f914738847f23"},{"url":"https://github.com/advisories/GHSA-m9gh-789g-q5pv"}],"tags":["ghsa","maven"],"epss":0.00192,"epssPercentile":0.07846,"ingestedAt":"2026-09-25T18:14:20.398Z","slug":"CVE-2025-37731","body":"## Overview\n\nImproper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.\n\n## Affected packages\n\n- `org.elasticsearch.plugin:x-pack-security >= 7.0.0-alpha1, < 8.19.8`\n- `org.elasticsearch.plugin:x-pack-security >= 9.0.0-beta1, < 9.1.8`\n- `org.elasticsearch.plugin:x-pack-security >= 9.2.0, < 9.2.2`\n- `org.elasticsearch.plugin:x-pack-core >= 7.0.0-alpha1, < 8.19.8`\n- `org.elasticsearch.plugin:x-pack-core >= 9.0.0-beta1, < 9.1.8`\n- `org.elasticsearch.plugin:x-pack-core >= 9.2.0, < 9.2.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `org.elasticsearch.plugin:x-pack-security 8.19.8`\n- `org.elasticsearch.plugin:x-pack-security 9.1.8`\n- `org.elasticsearch.plugin:x-pack-security 9.2.2`\n- `org.elasticsearch.plugin:x-pack-core 8.19.8`\n- `org.elasticsearch.plugin:x-pack-core 9.1.8`\n- `org.elasticsearch.plugin:x-pack-core 9.2.2`","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}