Improper Certificate Validation in Kibana Leading to Interception of TLS Connections
Improper Certificate Validation (CWE-295) in the Node.js runtime bundled with Kibana, a dependency of Kibana (Dependency on Vulnerable Third-Party Component, CWE-1395), could allow an attacker to intercept or modify TLS-protected traffic via Signature Spoofing by Key Theft (CAPEC-474). The root certificate store of the bundled Node.js runtime includes root certificate authorities that signed eight eMudhra intermediate certificate authorities whose private keys are compromised. Anyone with these keys can issue a certificate for any host name that Kibana accepts as trusted. Exploitation requires an attacker in a network position between Kibana and the remote party, who presents a certificate issued with one of the compromised keys that triggers CVE-2026-114406.
Affected Versions:
- 8.x: All versions from 8.0.0 up to and including 8.19.23
- 9.x:
- All versions from 9.0.0 up to and including 9.4.8
- All versions from 9.5.0 up to and including 9.5.5
Affected Configurations:
- The issue affects outbound TLS connections from the Kibana server for which Kibana uses the default root certificate store of the bundled Node.js runtime to verify certificates. This is the case when no specific certificate authorities are configured for that connection. Examples include connectors such as Webhook, Workflows HTTP requests, Fleet package registry requests, and connections to Elasticsearch when no certificate authority is configured for them.
Solutions and Mitigations:
The issue is resolved in versions 8.19.24, 9.4.9, and 9.5.6. These versions update the bundled Node.js runtime to 24.22.1, which removes the affected eMudhra root certificate authorities from its root certificate store.
The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the known issues for your target version before upgrading.
For Users that Cannot Upgrade:
Users of self-managed deployments can configure Kibana to use a root certificate store that does not include the affected eMudhra root certificate authorities, instead of the root certificate store of the bundled Node.js runtime:
1. Get a root certificate bundle that does not include the affected root certificate authorities, for example the Mozilla CA certificate extract from curl dated 2026-10-20 or later.
2. Add the line --use-openssl-ca to the config/node.options file of Kibana.
3. Set the SSL_CERT_FILE environment variable of the Kibana process to the path of this bundle.
4. Restart Kibana.
After this change, Kibana uses the certificate authorities in this bundle for the outbound connections that are listed in Affected Configurations. Connections that have specific certificate authorities configured do not change.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: High ( 7.4 ) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVE ID: CVE-2026-114406
Problem Type: CWE-295 - Improper Certificate Validation
Impact: CAPEC-474 - Signature Spoofing by Key Theft