CVE-2025-37731

score

<0.1

cvss

6.8

epss

0.2%

published

2025-12-15

kev added

—

first seen

2026-10-21

Elasticsearch contains an improper authentication vulnerability in the PKI realm caused by acceptance of specially crafted client certificates, letting attackers impersonate users, exploit requires attacker to have a crafted client certificate signed by a trusted CA.