CVE-2025-37731BIT-elasticsearch-2025-37731GHSA-m9gh-789g-q5pv
org.elasticsearch.plugin:x-pack-security: Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User Impersonation Through Crafted Client Certificates
Elastic org.elasticsearch.plugin:x-pack-securitymavenDatabases
CVSS
6.8MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.19%Chance of exploitation activity in the next 30 days, higher than 8% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 8.19.8org.elasticsearch.plugin:x-pack-security, mavenGitHub
<dependency><groupId>org.elasticsearch.plugin</groupId><artifactId>x-pack-security</artifactId><version>8.19.8</version></dependency> - 9.1.8org.elasticsearch.plugin:x-pack-security, mavenGitHub
<dependency><groupId>org.elasticsearch.plugin</groupId><artifactId>x-pack-security</artifactId><version>9.1.8</version></dependency> - 9.2.2org.elasticsearch.plugin:x-pack-security, mavenGitHub
<dependency><groupId>org.elasticsearch.plugin</groupId><artifactId>x-pack-security</artifactId><version>9.2.2</version></dependency> - 8.19.8org.elasticsearch.plugin:x-pack-core, mavenGitHub
<dependency><groupId>org.elasticsearch.plugin</groupId><artifactId>x-pack-core</artifactId><version>8.19.8</version></dependency> - 9.1.8org.elasticsearch.plugin:x-pack-core, mavenGitHub
<dependency><groupId>org.elasticsearch.plugin</groupId><artifactId>x-pack-core</artifactId><version>9.1.8</version></dependency> - 9.2.2org.elasticsearch.plugin:x-pack-core, mavenGitHub
<dependency><groupId>org.elasticsearch.plugin</groupId><artifactId>x-pack-core</artifactId><version>9.2.2</version></dependency>
Show all 12 fixed versions
- 8.19.8org.elasticsearch.plugin:x-pack-security, MavenOSV
<dependency><groupId>org.elasticsearch.plugin</groupId><artifactId>x-pack-security</artifactId><version>8.19.8</version></dependency> - 9.1.8org.elasticsearch.plugin:x-pack-security, MavenOSV
<dependency><groupId>org.elasticsearch.plugin</groupId><artifactId>x-pack-security</artifactId><version>9.1.8</version></dependency> - 9.2.2org.elasticsearch.plugin:x-pack-security, MavenOSV
<dependency><groupId>org.elasticsearch.plugin</groupId><artifactId>x-pack-security</artifactId><version>9.2.2</version></dependency> - 8.19.8org.elasticsearch.plugin:x-pack-core, MavenOSV
<dependency><groupId>org.elasticsearch.plugin</groupId><artifactId>x-pack-core</artifactId><version>8.19.8</version></dependency> - 9.1.8org.elasticsearch.plugin:x-pack-core, MavenOSV
<dependency><groupId>org.elasticsearch.plugin</groupId><artifactId>x-pack-core</artifactId><version>9.1.8</version></dependency> - 9.2.2org.elasticsearch.plugin:x-pack-core, MavenOSV
<dependency><groupId>org.elasticsearch.plugin</groupId><artifactId>x-pack-core</artifactId><version>9.2.2</version></dependency>
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.
Text from CVE List
Affected versions 158
- org.elasticsearch.plugin:x-pack-security, maven>= 7.0.0-alpha1, < 8.19.8GitHub
- org.elasticsearch.plugin:x-pack-security, maven>= 9.0.0-beta1, < 9.1.8GitHub
- org.elasticsearch.plugin:x-pack-security, maven>= 9.2.0, < 9.2.2GitHub
- org.elasticsearch.plugin:x-pack-core, maven>= 7.0.0-alpha1, < 8.19.8GitHub
- org.elasticsearch.plugin:x-pack-core, maven>= 9.0.0-beta1, < 9.1.8GitHub
- org.elasticsearch.plugin:x-pack-core, maven>= 9.2.0, < 9.2.2GitHub
- Elasticsearchaffected: 7.0.0 through 7.17.29CVE List
- Elasticsearchaffected: 8.0.0 through 8.19.7CVE List
- Elasticsearchaffected: 9.0.0 through 9.1.7CVE List
- Elasticsearchaffected: 9.2.0 through 9.2.1CVE List
- org.elasticsearch.plugin:x-pack-security, Mavenfrom 7.0.0-alpha1, fixed in 8.19.8OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.10.0OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.10.1OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.10.2OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.11.0OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.11.1OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.11.2OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.12.0OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.12.1OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.13.0OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.13.1OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.13.2OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.13.3OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.13.4OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.14.0OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.14.1OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.14.2OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.15.0OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.15.1OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.15.2OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.16.0OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.16.1OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.16.2OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.16.3OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.17.0OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.17.1OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.17.10OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.17.11OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.17.12OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.17.13OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.17.14OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.17.15OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.17.16OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.17.17OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.17.18OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.17.19OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.17.2OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.17.20OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.17.21OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.17.22OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.17.23OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.17.24OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.17.25OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.17.26OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.17.27OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.17.28OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.17.29OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.17.3OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.17.4OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.17.5OSV
- org.elasticsearch.plugin:x-pack-security, Maven7.17.6OSV
- org.elasticsearch.plugin:x-pack-security, Mavenfrom 9.0.0-beta1, fixed in 9.1.8OSV
- org.elasticsearch.plugin:x-pack-security, Maven9.0.0OSV
- org.elasticsearch.plugin:x-pack-security, Maven9.0.0-beta1OSV
- org.elasticsearch.plugin:x-pack-security, Maven9.0.0-rc1OSV
- org.elasticsearch.plugin:x-pack-security, Maven9.0.1OSV
- org.elasticsearch.plugin:x-pack-security, Maven9.0.2OSV
- org.elasticsearch.plugin:x-pack-security, Maven9.0.3OSV
- org.elasticsearch.plugin:x-pack-security, Maven9.0.4OSV
- org.elasticsearch.plugin:x-pack-security, Maven9.0.5OSV
- org.elasticsearch.plugin:x-pack-security, Maven9.0.6OSV
- org.elasticsearch.plugin:x-pack-security, Maven9.0.7OSV
- org.elasticsearch.plugin:x-pack-security, Maven9.0.8OSV
- org.elasticsearch.plugin:x-pack-security, Maven9.1.0OSV
- org.elasticsearch.plugin:x-pack-security, Maven9.1.1OSV
- org.elasticsearch.plugin:x-pack-security, Maven9.1.2OSV
- org.elasticsearch.plugin:x-pack-security, Maven9.1.3OSV
- org.elasticsearch.plugin:x-pack-security, Maven9.1.4OSV
- org.elasticsearch.plugin:x-pack-security, Maven9.1.5OSV
- org.elasticsearch.plugin:x-pack-security, Maven9.1.6OSV
- org.elasticsearch.plugin:x-pack-security, Maven9.1.7OSV
- org.elasticsearch.plugin:x-pack-security, Mavenfrom 9.2.0, fixed in 9.2.2OSV
- org.elasticsearch.plugin:x-pack-security, Maven9.2.0OSV
- org.elasticsearch.plugin:x-pack-security, Maven9.2.1OSV
- org.elasticsearch.plugin:x-pack-core, Mavenfrom 7.0.0-alpha1, fixed in 8.19.8OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.10.0OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.10.1OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.10.2OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.11.0OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.11.1OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.11.2OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.12.0OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.12.1OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.13.0OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.13.1OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.13.2OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.13.3OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.13.4OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.14.0OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.14.1OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.14.2OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.15.0OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.15.1OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.15.2OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.16.0OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.16.1OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.16.2OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.16.3OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.17.0OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.17.1OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.17.10OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.17.11OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.17.12OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.17.13OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.17.14OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.17.15OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.17.16OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.17.17OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.17.18OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.17.19OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.17.2OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.17.20OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.17.21OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.17.22OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.17.23OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.17.24OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.17.25OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.17.26OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.17.27OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.17.28OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.17.29OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.17.3OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.17.4OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.17.5OSV
- org.elasticsearch.plugin:x-pack-core, Maven7.17.6OSV
- org.elasticsearch.plugin:x-pack-core, Mavenfrom 9.0.0-beta1, fixed in 9.1.8OSV
- org.elasticsearch.plugin:x-pack-core, Maven9.0.0OSV
- org.elasticsearch.plugin:x-pack-core, Maven9.0.0-beta1OSV
- org.elasticsearch.plugin:x-pack-core, Maven9.0.0-rc1OSV
- org.elasticsearch.plugin:x-pack-core, Maven9.0.1OSV
- org.elasticsearch.plugin:x-pack-core, Maven9.0.2OSV
- org.elasticsearch.plugin:x-pack-core, Maven9.0.3OSV
- org.elasticsearch.plugin:x-pack-core, Maven9.0.4OSV
- org.elasticsearch.plugin:x-pack-core, Maven9.0.5OSV
- org.elasticsearch.plugin:x-pack-core, Maven9.0.6OSV
- org.elasticsearch.plugin:x-pack-core, Maven9.0.7OSV
- org.elasticsearch.plugin:x-pack-core, Maven9.0.8OSV
- org.elasticsearch.plugin:x-pack-core, Maven9.1.0OSV
- org.elasticsearch.plugin:x-pack-core, Maven9.1.1OSV
- org.elasticsearch.plugin:x-pack-core, Maven9.1.2OSV
- org.elasticsearch.plugin:x-pack-core, Maven9.1.3OSV
- org.elasticsearch.plugin:x-pack-core, Maven9.1.4OSV
- org.elasticsearch.plugin:x-pack-core, Maven9.1.5OSV
- org.elasticsearch.plugin:x-pack-core, Maven9.1.6OSV
- org.elasticsearch.plugin:x-pack-core, Maven9.1.7OSV
- org.elasticsearch.plugin:x-pack-core, Mavenfrom 9.2.0, fixed in 9.2.2OSV
- org.elasticsearch.plugin:x-pack-core, Maven9.2.0OSV
- org.elasticsearch.plugin:x-pack-core, Maven9.2.1OSV
References 6
- github.com/elastic/elasticsearch/commit/cd97b8566bf56e628070021300784cb9cee0286fFixvia GitHub
- github.com/elastic/elasticsearch/commit/d8a408da79f214395845d99d241e832077045983Fixvia GitHub
- github.com/elastic/elasticsearch/commit/e519fe4c51a3c887675eb7daea2f914738847f23Fixvia GitHub
- discuss.elastic.co/t/elasticsearch-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-27/384063Advisoryvia CVE List
- github.com/advisories/GHSA-m9gh-789g-q5pvAdvisoryvia GitHub
- nvd.nist.gov/vuln/detail/CVE-2025-37731Referencevia GitHub