Improper Certificate Validation (CWE-295) exists in the operating system certificate bundle shipped with Elastic Docker images. The bundle contains eight eMudhra intermediate certificates whose private keys have been compromised, allowing an attacker to issue trusted certificates for any host name accepted by the affected products. A malicious actor can exploit this flaw to intercept, read, or modify TLS‑protected traffic, thereby compromising confidentiality and integrity.

The vulnerability affects Elastic Docker images for APM Server, Auditbeat, Filebeat, Heartbeat, Metricbeat, Packetbeat, Elastic Agent (including Fleet Server and Cloudbeat), Logstash, Elastic connectors, Universal Profiling (host agent, collector, symbolizer), and Elastic Maps Server. No specific version information is provided, so all current Docker images containing the bundled OS certificate set are potentially impacted.

The CVSS score of 7.4 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to be positioned between the product and the remote party and to present a certificate issued with a compromised key. If the attacker can intercept network traffic, they can mount a man‑in‑the‑middle attack that is straightforward to execute given the compromised intermediates. Even without a KEV listing, the high CVSS and the ability to spoof certificates make this vulnerability a significant risk to all affected deployments.