Database/Control plane, storage & DevOps
Elastic Docker images: CA bundle trusts compromised intermediates, allowing TLS interception
Impact
The OS certificate bundle baked into Elastic's Docker images trusts roots that signed eight eMudhra intermediate CAs whose private keys are compromised. Anyone holding those keys can mint a certificate for any hostname these components accept, so an attacker in a network position between a Beat, Elastic Agent, Logstash, APM Server or Universal Profiling agent and its destination can read or alter TLS-protected traffic. On a GPU fleet these agents run on every node and ship logs, metrics and profiles that often include credentials and job detail, and Fleet Server traffic carries agent enrollment. This is a trust-store problem, not a code bug - no exploit against Elastic itself is needed.
Who can reach it
An attacker positioned between an Elastic container and the remote party it connects to, presenting a certificate issued under one of the compromised intermediates. No authentication needed.
What to do
Pull the updated Elastic Docker images (8.19.24, 9.4.9 and 9.5.6 per the Elastic notice) and redeploy the affected agents and servers; on a Kubernetes fleet that is a DaemonSet/Deployment image roll, not a node reboot. Where an immediate roll is not possible, pin trust explicitly with your own CA bundle or certificate pinning for these connections.
References
Related entries
- Confluent Kafka Python client: TLS certificate verification disabled by default toward HashiCorp Vault KMSCVE-2026-15911 · Confluent Kafka Python client (HashiCorp Vault KMS integration)High
- N-able N-central: Authentication bypass using an alternate path or channel on the RMM serverCVE-2026-18556 · N-able N-centralHigh
- Jenkins TICS plugin: attacker-controlled build variables execute arbitrary commands on the build agentCVE-2026-84675 · Jenkins TICS plugin (build environment variable expansion into an OS command)High
- Sigstore cosign (verify-blob / verify-blob-attestation, legacy JSON bundle): SUPPLY CHAIN, VERIFICATION BYPASS: keylessNCVD-2026-056-sigstore-cosign-verify-blob-veri · Sigstore cosign (verify-blob / verify-blob-attestation, legacy JSON bundle)High
- Grafana: Stored XSS via Unified AlertingCVE-2022-31097 · GrafanaHigh
- Linux i915 GVT-g mediated GPU virtualisation (debugfs teardown): Companion to the vGPU debugfs cleanup bug: GVT-gCVE-2023-54098 · Linux i915 GVT-g mediated GPU virtualisation (debugfs teardown)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.