{"schema":"threatline.record/2","record":{"id":"CVE-2025-37731","aliases":["BIT-elasticsearch-2025-37731","GHSA-m9gh-789g-q5pv"],"summary":"Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User Impersonation Through Crafted Client Certificates","details":"Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.","categories":["Databases"],"product":"org.elasticsearch.plugin:x-pack-security","vendor":"Elastic","ecosystem":"maven","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-m9gh-789g-q5pv","source_modified_at":"2026-09-25T17:36:28Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.elasticsearch.plugin:x-pack-security"},"range":">= 7.0.0-alpha1, < 8.19.8"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-m9gh-789g-q5pv","source_modified_at":"2026-09-25T17:36:28Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.elasticsearch.plugin:x-pack-security"},"range":">= 9.0.0-beta1, < 9.1.8"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-m9gh-789g-q5pv","source_modified_at":"2026-09-25T17:36:28Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.elasticsearch.plugin:x-pack-security"},"range":">= 9.2.0, < 9.2.2"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-m9gh-789g-q5pv","source_modified_at":"2026-09-25T17:36:28Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.elasticsearch.plugin:x-pack-core"},"range":">= 7.0.0-alpha1, < 8.19.8"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-m9gh-789g-q5pv","source_modified_at":"2026-09-25T17:36:28Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.elasticsearch.plugin:x-pack-core"},"range":">= 9.0.0-beta1, < 9.1.8"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-m9gh-789g-q5pv","source_modified_at":"2026-09-25T17:36:28Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.elasticsearch.plugin:x-pack-core"},"range":">= 9.2.0, < 9.2.2"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-37731","source_modified_at":"2026-02-26T16:07:40.327Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Elasticsearch","vendor":"Elastic","versions":[{"lessThanOrEqual":"7.17.29","status":"affected","version":"7.0.0","versionType":"semver"},{"lessThanOrEqual":"8.19.7","status":"affected","version":"8.0.0","versionType":"semver"},{"lessThanOrEqual":"9.1.7","status":"affected","version":"9.0.0","versionType":"semver"},{"lessThanOrEqual":"9.2.1","status":"affected","version":"9.2.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-m9gh-789g-q5pv","source_modified_at":"2026-09-25T17:45:05.048500029Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.elasticsearch.plugin:x-pack-security","purl":"pkg:maven/org.elasticsearch.plugin/x-pack-security"},"ranges":[{"events":[{"introduced":"7.0.0-alpha1"},{"fixed":"8.19.8"}],"type":"ECOSYSTEM"}],"versions":["7.10.0","7.10.1","7.10.2","7.11.0","7.11.1","7.11.2","7.12.0","7.12.1","7.13.0","7.13.1","7.13.2","7.13.3","7.13.4","7.14.0","7.14.1","7.14.2","7.15.0","7.15.1","7.15.2","7.16.0","7.16.1","7.16.2","7.16.3","7.17.0","7.17.1","7.17.10","7.17.11","7.17.12","7.17.13","7.17.14","7.17.15","7.17.16","7.17.17","7.17.18","7.17.19","7.17.2","7.17.20","7.17.21","7.17.22","7.17.23","7.17.24","7.17.25","7.17.26","7.17.27","7.17.28","7.17.29","7.17.3","7.17.4","7.17.5","7.17.6"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-m9gh-789g-q5pv","source_modified_at":"2026-09-25T17:45:05.048500029Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.elasticsearch.plugin:x-pack-security","purl":"pkg:maven/org.elasticsearch.plugin/x-pack-security"},"ranges":[{"events":[{"introduced":"9.0.0-beta1"},{"fixed":"9.1.8"}],"type":"ECOSYSTEM"}],"versions":["9.0.0","9.0.0-beta1","9.0.0-rc1","9.0.1","9.0.2","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.1.0","9.1.1","9.1.2","9.1.3","9.1.4","9.1.5","9.1.6","9.1.7"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-m9gh-789g-q5pv","source_modified_at":"2026-09-25T17:45:05.048500029Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.elasticsearch.plugin:x-pack-security","purl":"pkg:maven/org.elasticsearch.plugin/x-pack-security"},"ranges":[{"events":[{"introduced":"9.2.0"},{"fixed":"9.2.2"}],"type":"ECOSYSTEM"}],"versions":["9.2.0","9.2.1"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-m9gh-789g-q5pv","source_modified_at":"2026-09-25T17:45:05.048500029Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.elasticsearch.plugin:x-pack-core","purl":"pkg:maven/org.elasticsearch.plugin/x-pack-core"},"ranges":[{"events":[{"introduced":"7.0.0-alpha1"},{"fixed":"8.19.8"}],"type":"ECOSYSTEM"}],"versions":["7.10.0","7.10.1","7.10.2","7.11.0","7.11.1","7.11.2","7.12.0","7.12.1","7.13.0","7.13.1","7.13.2","7.13.3","7.13.4","7.14.0","7.14.1","7.14.2","7.15.0","7.15.1","7.15.2","7.16.0","7.16.1","7.16.2","7.16.3","7.17.0","7.17.1","7.17.10","7.17.11","7.17.12","7.17.13","7.17.14","7.17.15","7.17.16","7.17.17","7.17.18","7.17.19","7.17.2","7.17.20","7.17.21","7.17.22","7.17.23","7.17.24","7.17.25","7.17.26","7.17.27","7.17.28","7.17.29","7.17.3","7.17.4","7.17.5","7.17.6"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-m9gh-789g-q5pv","source_modified_at":"2026-09-25T17:45:05.048500029Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.elasticsearch.plugin:x-pack-core","purl":"pkg:maven/org.elasticsearch.plugin/x-pack-core"},"ranges":[{"events":[{"introduced":"9.0.0-beta1"},{"fixed":"9.1.8"}],"type":"ECOSYSTEM"}],"versions":["9.0.0","9.0.0-beta1","9.0.0-rc1","9.0.1","9.0.2","9.0.3","9.0.4","9.0.5","9.0.6","9.0.7","9.0.8","9.1.0","9.1.1","9.1.2","9.1.3","9.1.4","9.1.5","9.1.6","9.1.7"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-m9gh-789g-q5pv","source_modified_at":"2026-09-25T17:45:05.048500029Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.elasticsearch.plugin:x-pack-core","purl":"pkg:maven/org.elasticsearch.plugin/x-pack-core"},"ranges":[{"events":[{"introduced":"9.2.0"},{"fixed":"9.2.2"}],"type":"ECOSYSTEM"}],"versions":["9.2.0","9.2.1"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-m9gh-789g-q5pv","source_modified_at":"2026-09-25T17:36:28Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.elasticsearch.plugin:x-pack-security"},"version":"8.19.8"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-m9gh-789g-q5pv","source_modified_at":"2026-09-25T17:36:28Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.elasticsearch.plugin:x-pack-security"},"version":"9.1.8"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-m9gh-789g-q5pv","source_modified_at":"2026-09-25T17:36:28Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.elasticsearch.plugin:x-pack-security"},"version":"9.2.2"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-m9gh-789g-q5pv","source_modified_at":"2026-09-25T17:36:28Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.elasticsearch.plugin:x-pack-core"},"version":"8.19.8"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-m9gh-789g-q5pv","source_modified_at":"2026-09-25T17:36:28Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.elasticsearch.plugin:x-pack-core"},"version":"9.1.8"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-m9gh-789g-q5pv","source_modified_at":"2026-09-25T17:36:28Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.elasticsearch.plugin:x-pack-core"},"version":"9.2.2"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-m9gh-789g-q5pv","source_modified_at":"2026-09-25T17:45:05.048500029Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.elasticsearch.plugin:x-pack-security","purl":"pkg:maven/org.elasticsearch.plugin/x-pack-security"},"version":"8.19.8"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-m9gh-789g-q5pv","source_modified_at":"2026-09-25T17:45:05.048500029Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.elasticsearch.plugin:x-pack-security","purl":"pkg:maven/org.elasticsearch.plugin/x-pack-security"},"version":"9.1.8"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-m9gh-789g-q5pv","source_modified_at":"2026-09-25T17:45:05.048500029Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.elasticsearch.plugin:x-pack-security","purl":"pkg:maven/org.elasticsearch.plugin/x-pack-security"},"version":"9.2.2"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-m9gh-789g-q5pv","source_modified_at":"2026-09-25T17:45:05.048500029Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.elasticsearch.plugin:x-pack-core","purl":"pkg:maven/org.elasticsearch.plugin/x-pack-core"},"version":"8.19.8"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-m9gh-789g-q5pv","source_modified_at":"2026-09-25T17:45:05.048500029Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.elasticsearch.plugin:x-pack-core","purl":"pkg:maven/org.elasticsearch.plugin/x-pack-core"},"version":"9.1.8"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-m9gh-789g-q5pv","source_modified_at":"2026-09-25T17:45:05.048500029Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"org.elasticsearch.plugin:x-pack-core","purl":"pkg:maven/org.elasticsearch.plugin/x-pack-core"},"version":"9.2.2"}],"cvss":6.8,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00192,"percentile":0.08356,"score_date":"2026-10-23"},"published_at":"2025-12-15T10:42:21.840Z","modified_at":"2026-09-25T17:45:05.048500029Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-m9gh-789g-q5pv","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-25T17:36:28Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2025-37731","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-02-26T16:07:40.327Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-m9gh-789g-q5pv","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-25T17:45:05.048500029Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-37731","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37731","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://discuss.elastic.co/t/elasticsearch-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-27/384063"},{"url":"https://github.com/elastic/elasticsearch/commit/cd97b8566bf56e628070021300784cb9cee0286f","source":"GitHub Advisory Database"},{"url":"https://github.com/elastic/elasticsearch/commit/d8a408da79f214395845d99d241e832077045983","source":"GitHub Advisory Database"},{"url":"https://github.com/elastic/elasticsearch/commit/e519fe4c51a3c887675eb7daea2f914738847f23","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-m9gh-789g-q5pv","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2025-12-16T04:56:03.191864Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-25T17:45:05.048500029Z","content_hash":"de4b2e20892d5b9e0de047751b7c49ed15f08097a7489c2b3487fdde5867950b"}}