Elastic Docker Images EUVD-2026-116082

Three concrete conditions must all hold: (1) the affected Elastic product (APM Server; Auditbeat/Filebeat/Heartbeat/Metricbeat/Packetbeat; Elastic Agent including Fleet Server and Cloudbeat; Logstash; Elastic connectors; Universal Profiling host agent/collector/symbolizer; or Elastic Maps Server) must be the Docker-image build that ships the vulnerable OS certificate bundle; (2) the TLS connection in question must be one that uses that operating-system certificate bundle for trust validation; and (3) the attacker must occupy a man-in-the-middle position between the product and the remote party AND possess one of the eight compromised eMudhra intermediate CA private keys to mint a trusted forged certificate. Limiting factors: no authentication is needed (PR:N), but the mandatory network-interception position plus key possession give AC:H and make this difficult to execute at scale; connections that do not rely on the OS bundle are unaffected.

This is a genuine but conditional integrity/confidentiality risk, not an opportunistic remote-code-execution emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, 7.4 High) is internally consistent with the description: no authentication is required (PR:N) but attack complexity is High (AC:H) because the attacker must both occupy a man-in-the-middle network position and hold one of the eight compromised eMudhra intermediate CA private keys. The vuln.today priority is 'this_week' rather than act_now/emergency, which aligns with the signal set. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no public exploit or PoC reference is present - only an Elastic vendor advisory. There is therefore no evidence of active exploitation; the real-world risk is gated by the two AC:H prerequisites. Note the Tags label this 'Information Disclosure', but the description and the I:H metric make clear this is equally a traffic-modification (integrity) flaw, not purely disclosure - do not treat it as read-only eavesdropping. The dependency on a compromised-key CA bundle (CWE-295/CWE-1395) is real and concrete, so this warrants prompt patching, but absent KEV/EPSS/PoC it is a prioritized-but-not-critical issue dependent on an attacker already achieving network interception.

An attacker positioned on the network path between an affected Elastic Docker container and a remote TLS endpoint presents a server certificate forged with one of the eight compromised eMudhra intermediate CA keys; because the product's OS certificate bundle still trusts the signing roots, the forged certificate validates and the attacker transparently intercepts or alters the TLS-protected traffic. No public exploit or PoC code is identified at time of analysis; exploitation is constrained by the need for both a privileged network position and possession of a compromised key.