---
id: CVE-2025-37731
aliases:
  - GHSA-m9gh-789g-q5pv
title: >-
  Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User
  Impersonation Through Crafted Client Certificates
summary: >-
  Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User
  Impersonation Through Crafted Client Certificates
severity: medium
cvss: 6.8
cwe:
  - CWE-287
  - CWE-295
vendor: elasticsearch
product: 'org.elasticsearch.plugin:x-pack-security'
ecosystem: maven
affected:
  - 'org.elasticsearch.plugin:x-pack-security >= 7.0.0-alpha1, < 8.19.8'
  - 'org.elasticsearch.plugin:x-pack-security >= 9.0.0-beta1, < 9.1.8'
  - 'org.elasticsearch.plugin:x-pack-security >= 9.2.0, < 9.2.2'
  - 'org.elasticsearch.plugin:x-pack-core >= 7.0.0-alpha1, < 8.19.8'
  - 'org.elasticsearch.plugin:x-pack-core >= 9.0.0-beta1, < 9.1.8'
  - 'org.elasticsearch.plugin:x-pack-core >= 9.2.0, < 9.2.2'
patched:
  - 'org.elasticsearch.plugin:x-pack-security 8.19.8'
  - 'org.elasticsearch.plugin:x-pack-security 9.1.8'
  - 'org.elasticsearch.plugin:x-pack-security 9.2.2'
  - 'org.elasticsearch.plugin:x-pack-core 8.19.8'
  - 'org.elasticsearch.plugin:x-pack-core 9.1.8'
  - 'org.elasticsearch.plugin:x-pack-core 9.2.2'
published: '2025-12-15'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T17:36:28Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-m9gh-789g-q5pv'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-37731'
  - url: >-
      https://discuss.elastic.co/t/elasticsearch-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-27/384063
  - url: >-
      https://github.com/elastic/elasticsearch/commit/cd97b8566bf56e628070021300784cb9cee0286f
  - url: >-
      https://github.com/elastic/elasticsearch/commit/d8a408da79f214395845d99d241e832077045983
  - url: >-
      https://github.com/elastic/elasticsearch/commit/e519fe4c51a3c887675eb7daea2f914738847f23
  - url: 'https://github.com/advisories/GHSA-m9gh-789g-q5pv'
tags:
  - ghsa
  - maven
epss: 0.00192
epssPercentile: 0.07846
ingestedAt: '2026-09-25T18:14:20.398Z'
---

## Overview

Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.

## Affected packages

- `org.elasticsearch.plugin:x-pack-security >= 7.0.0-alpha1, < 8.19.8`
- `org.elasticsearch.plugin:x-pack-security >= 9.0.0-beta1, < 9.1.8`
- `org.elasticsearch.plugin:x-pack-security >= 9.2.0, < 9.2.2`
- `org.elasticsearch.plugin:x-pack-core >= 7.0.0-alpha1, < 8.19.8`
- `org.elasticsearch.plugin:x-pack-core >= 9.0.0-beta1, < 9.1.8`
- `org.elasticsearch.plugin:x-pack-core >= 9.2.0, < 9.2.2`

## Remediation

Upgrade to a patched release:

- `org.elasticsearch.plugin:x-pack-security 8.19.8`
- `org.elasticsearch.plugin:x-pack-security 9.1.8`
- `org.elasticsearch.plugin:x-pack-security 9.2.2`
- `org.elasticsearch.plugin:x-pack-core 8.19.8`
- `org.elasticsearch.plugin:x-pack-core 9.1.8`
- `org.elasticsearch.plugin:x-pack-core 9.2.2`