Elastic: Improper certificate validation in OS certificate bundles (CVE-2026-115714)
Multiple Elastic products are vulnerable to TLS interception due to a dependency on an operating system certificate bundle containing eight compromised eMudhra intermediate certificate authorities.
CVE search metadata
CVE search record: CVE-2026-115714. Severity: high. CVSS: 7.4. KEV: no. Product: APM Server, Auditbeat, Filebeat, Heartbeat, Metricbeat, Packetbeat, Elastic Agent, Fleet Server, Cloudbeat, Logstash, Elastic connectors, Universal Profiling, Elastic Maps Server. Brief: Elastic: Improper certificate validation in OS certificate bundles (CVE-2026-115714). Brief link: https://feed.craftedsignal.io/briefs/2026-11-elastic-cve-2026-115714/
Triage facts
Revision 1- Applicability
- APM Server, Auditbeat +11
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 3, 20:01 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CVE-2026-115714 identifies an improper certificate validation vulnerability (CWE-295) affecting the operating system certificate bundle used by several Elastic products, including APM Server, various Beats (Auditbeat, Filebeat, Heartbeat, Metricbeat, Packetbeat), Elastic Agent (including Fleet Server and Cloudbeat), Logstash, Elastic connectors, Universal Profiling, and Elastic Maps Server. The bundle includes eight eMudhra intermediate certificate authorities whose private keys are compromised. This allows an attacker in a network position between the product and a remote party to intercept or modify TLS-protected traffic by presenting a certificate issued by these compromised keys.