Improper Certificate Validation in Heartbeat Leading to Interception of TLS Connections
Improper Certificate Validation (CWE-295) in the Node.js runtime bundled with the Heartbeat Docker image, a dependency of Heartbeat (Dependency on Vulnerable Third-Party Component, CWE-1395), could allow an attacker to intercept or modify TLS-protected traffic of Synthetics browser monitors via Signature Spoofing by Key Theft (CAPEC-474). The root certificate store of the bundled Node.js runtime includes root certificate authorities that signed eight eMudhra intermediate certificate authorities whose private keys are compromised. Anyone with these keys can issue a certificate for any host name that the Node.js runtime accepts as trusted. Exploitation requires an attacker in a network position between Heartbeat and the monitored service, who presents a certificate issued with one of the compromised keys that triggers CVE-2026-114406.
Affected Versions:
- 8.x: All versions from 8.0.0 up to and including 8.19.23
- 9.x:
- All versions from 9.0.0 up to and including 9.4.8
- All versions from 9.5.0 up to and including 9.5.5
Affected Configurations:
- Heartbeat Docker images that run Synthetics browser monitors. The issue affects TLS connections that the bundled Node.js runtime makes for these monitors.
- Lightweight monitors use the trust store of the operating system and are not affected by the bundled Node.js runtime. Users must apply the certificate update from their operating system vendor.
- Heartbeat installations that run Synthetics browser monitors on a Node.js runtime that is not bundled with Heartbeat are affected if that runtime still trusts the affected root certificate authorities. These users must update that Node.js runtime.
Solutions and Mitigations:
The issue is resolved in versions 8.19.24, 9.4.9, and 9.5.6. These versions update the Node.js runtime in the Heartbeat Docker image to 22.23.4, which removes the affected eMudhra root certificate authorities from its root certificate store.
The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the known issues for your target version before upgrading.
For Users that Cannot Upgrade:
There are no workarounds for this vulnerability.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Severity: CVSSv3.1: High ( 7.4 ) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVE ID: CVE-2026-114406
Problem Type: CWE-295 - Improper Certificate Validation
Impact: CAPEC-474 - Signature Spoofing by Key Theft