Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted
    client certificates. A malicious actor would need to have such a crafted client certificate signed by a
    legitimate, trusted Certificate Authority. (CVE-2025-37731)

The version of Elasticsearch installed on the remote host is 7.0 prior to 8.19.8, 9.0 prior to 9.1.8, or 9.2.0 prior to 9.2.2. It is, therefore, affected by a vulnerability as referenced in the ESA-2025-27 advisory.

  - Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under     specific preconditions when auditing requests to the reindex API. (CVE-2025-37731)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted     client certificates. A malicious actor would need to have such a crafted client certificate signed by a     legitimate, trusted Certificate Authority. (CVE-2025-37731)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
459179	Echo: org.elasticsearch:elasticsearch: security update to 8.19.8	Tenable Cloud Security	Echo Local Security Checks	Local	high
459179	Echo: org.elasticsearch:elasticsearch: security update to 8.19.8	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
279410	Elasticsearch 7.0.x < 8.19.8 / 9.0.x < 9.1.8 / 9.2.x < 9.2.2 (ESA-2025-27)	Nessus	Misc.	Combined	high
436401	SCA: security update for org.elasticsearch:elasticsearch (GHSA-m9gh-789g-q5pv)	Tenable Cloud Security	SCA Checks	Local	high
436401	SCA: security update for org.elasticsearch:elasticsearch (GHSA-m9gh-789g-q5pv)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
278778	Linux Distros Unpatched Vulnerability : CVE-2025-37731	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2025-37731

high

Tenable Plugins

high

high

high

high

high

high