Elasticsearch CVE-2025-37731

Exploitation requires the Elasticsearch PKI (public key infrastructure) realm to be enabled and configured for client-certificate authentication - this is not a default authentication mode and must be explicitly set up by the operator. The attacker must additionally possess a specially crafted X.509 client certificate that is signed by a Certificate Authority already configured as trusted by the target cluster's PKI realm; a self-signed or untrusted-CA certificate will not work. The practical limiting factor is therefore access to a certificate from a trusted CA that can be manipulated into impersonating another user, which confines realistic exploitation to environments where the trusted CA issues certificates beyond the intended high-trust population. No user interaction is required, but the certificate prerequisite and the need for a PKI-realm deployment substantially narrow the exposed population.

This is a genuine but conditionally-gated authentication-bypass issue rather than a mass-exploitation emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N = 7.4 High) correctly captures the tension in this flaw: the attack is network-reachable and requires no pre-existing privileges (PR:N, because the vulnerability IS the authentication bypass), but carries High attack complexity (AC:H) because the attacker must possess a specially crafted client certificate signed by a legitimate, trusted Certificate Authority that the target Elasticsearch cluster already trusts. No EPSS score, CISA KEV entry, or public POC was provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The high-impact confidentiality and integrity rating (C:H/I:H) is plausible because successful impersonation grants the privileges of the impersonated user, potentially including administrative accounts. The decisive limiting factor - obtaining a cert from a CA already trusted by the PKI realm - means real-world risk is concentrated in environments where the trusted CA also issues certificates to lower-trust or externally-reachable parties, making this a targeted/conditional risk rather than a broadly wormable one. Note the key gaps: no EPSS, KEV, POC, or SSVC data was supplied, so exploitation-likelihood signals are entirely absent and this assessment rests on the CVSS vector and vendor description alone.

In a cluster using the Elasticsearch PKI realm for certificate-based authentication, an attacker who can obtain a client certificate signed by a CA the cluster trusts crafts that certificate so its fields cause the PKI realm to map the connection to a different, higher-privileged user identity. Presenting the crafted certificate over the network, the attacker is authenticated as the impersonated user and gains that user's read/write access to indices and cluster APIs. No public exploit code was identified at time of analysis, and success hinges on the attacker first acquiring a cert from a trusted CA.