Improper Certificate Validation in Elastic Agent Leading to Interception of TLS Connections
Improper Certificate Validation (CWE-295) in the Node.js runtime bundled with the Elastic Agent “Complete Flavor” Docker images that include Synthetics, a dependency of Elastic Agent “Complete Flavor” (Dependency on Vulnerable Third-Party Component, CWE-1395), could allow an attacker to intercept or modify TLS-protected traffic of Synthetics browser monitors via Signature Spoofing by Key Theft (CAPEC-474). The root certificate store of the bundled Node.js runtime includes root certificate authorities that signed eight eMudhra intermediate certificate authorities whose private keys are compromised. Anyone with these keys can issue a certificate for any host name that the Node.js runtime accepts as trusted. Exploitation requires an attacker in a network position between Elastic Agent and the monitored service, who presents a certificate issued with one of the compromised keys that triggers CVE-2026-114406.
Affected Versions:
- 8.x: All versions from 8.0.0 up to and including 8.19.23
- 9.x:
- All versions from 9.0.0 up to and including 9.4.8
- All versions from 9.5.0 up to and including 9.5.5
Affected Configurations:
- Elastic Agent “Complete Flavor” Docker images that include Synthetics (the complete images flavor) and run Synthetics browser monitors, including Private Locations. The issue affects TLS connections that the bundled Node.js runtime makes for these monitors.
- Lightweight Synthetics monitors use the trust store of the operating system and are not affected by the bundled Node.js runtime. Users must apply the certificate update from their operating system vendor.
- Elastic Agent installations that run Synthetics browser monitors on a Node.js runtime that is not bundled with Elastic Agent are affected if that runtime still trusts the affected root certificate authorities. These users must update that Node.js runtime.
Solutions and Mitigations:
The issue is resolved in versions 8.19.24, 9.4.9, and 9.5.6. These versions update the Node.js runtime in the Elastic Agent Docker images that include Synthetics to 22.23.4, which removes the affected eMudhra root certificate authorities from its root certificate store.
The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the known issues for your target version before upgrading.
For Users that Cannot Upgrade:
There are no workarounds for this vulnerability.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Severity: CVSSv3.1: High ( 7.4 ) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVE ID: CVE-2026-114406
Problem Type: CWE-295 - Improper Certificate Validation
Impact: CAPEC-474 - Signature Spoofing by Key Theft