# Multiple Elastic Docker images 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-237) **URL:** \ **Category:** Security Announcements\ **Tags:** docker\ **Created:** [November 3, 2026, 4:33pm UTC](https://discuss.elastic.co/t/multiple-elastic-docker-images-8-19-24-9-4-9-9-5-6-security-update-esa-2026-237/391374 "2026-11-03T16:33:53Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![Bryan\_Garcia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bryan_garcia/32/148179_2.png) [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Post date:** [November 3, 2026, 4:33pm UTC](https://discuss.elastic.co/t/multiple-elastic-docker-images-8-19-24-9-4-9-9-5-6-security-update-esa-2026-237/391374/1 "2026-11-03T16:33:53Z")
**Improper Certificate Validation in Elastic Docker Images Leading to Interception of TLS Connections** Improper Certificate Validation (CWE-295) in the operating system certificate bundle shipped in the Docker images of - APM Server - Auditbeat, Filebeat, Heartbeat, Metricbeat and Packetbeat - Elastic Agent, including Fleet Server and Cloudbeat - Logstash, for TLS connections that use the operating system certificate bundle - Elastic connectors - Universal Profiling (host agent, collector and symbolizer) - Elastic Maps Server A dependency of these products (Dependency on Vulnerable Third-Party Component, CWE-1395), could allow an attacker to intercept or modify TLS-protected traffic via Signature Spoofing by Key Theft (CAPEC-474). The certificate bundle includes root certificate authorities that signed eight eMudhra intermediate certificate authorities whose private keys are compromised. Anyone with these keys can issue a certificate for any host name that these products accept as trusted. Exploitation requires an attacker in a network position between the product and the remote party, who presents a certificate issued with one of the compromised keys. **Affected Versions:** - 8.x: All versions from 8.0.0 up to and including 8.19.23 - 9.x: - All versions from 9.0.0 up to and including 9.4.8 - All versions from 9.5.0 up to and including 9.5.5 **Affected Configurations:** - The official Elastic Docker images of the products listed above. - The issue affects TLS connections for which the product uses the default trust store of the operating system in the image. This is the case when no specific certificate authorities are configured for that connection, for example when `ssl.certificate_authorities` is not set. - Installations from packages or archives use the trust store of the host operating system and are not affected by this advisory. Apply the certificate update from your operating system vendor. - Logstash uses two trust stores. Most TLS connections use the trust store of the bundled Java runtime, which ESA-2026-228 covers. Some connections use the operating system certificate bundle in the Docker image, which this advisory covers. The fixed versions update both trust stores. - The Elasticsearch and Kibana Docker images are covered by ESA-2026-227 and ESA-2026-229. These products use their bundled Java or Node.js runtime, not the operating system certificate bundle. Synthetics browser monitors in the Heartbeat and Elastic Agent Docker images are covered by ESA-2026-230 and ESA-2026-231. **Solutions and Mitigations:** The issue is resolved in versions 8.19.24, 9.4.9, and 9.5.6. The Docker images of these versions update the operating system certificate bundle, which removes the affected eMudhra root certificate authorities. The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the [known issues](https://www.elastic.co/docs/release-notes) for your target version before upgrading. **For Users that Cannot Upgrade:** There are no workarounds for this vulnerability. **Indicators of Compromise (IOC)** No specific indicators of compromise have been identified for this vulnerability. **Severity:** CVSSv3.1: High ( 7.4 ) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N **CVE ID:** CVE-2026-115714 **Problem Type:** CWE-295 - Improper Certificate Validation **Impact:** CAPEC-474 - Signature Spoofing by Key Theft