{"id":"CVE-2023-31421","aliases":["EUVD-2023-35729","GHSA-4x46-8gg7-f9vx"],"status":"published","title":"Beats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issue","description":"It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether the server certificate is valid for the target IP address; however, certificate signature validation is still performed. More specifically, when the client is configured to connect to an IP address (instead of a hostname) it does not validate the server certificate's IP SAN values against that IP address and certificate validation fails, and therefore the connection is not blocked as expected.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00323,"percentile":0.257,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-295"],"published":"2023-10-26T03:10:52Z","modified":"2026-10-28T02:30:47Z","products":[{"vendor":"elastic","product":"apm server"},{"vendor":"elastic","product":"apm_server"},{"vendor":"elastic","product":"beats"},{"vendor":"elastic","product":"elastic agent"},{"vendor":"elastic","product":"elastic_agent"},{"vendor":"elastic","product":"elastic_beats"},{"vendor":"elastic","product":"elastic_fleet_server"},{"vendor":"elastic","product":"fleet server"}],"references":[{"url":"https://discuss.elastic.co/t/beats-elastic-agent-apm-server-and-fleet-server-8-10-1-security-update-improper-certificate-validation-issue-esa-2023-16/343385","tags":["x_transferred","Vendor Advisory","web"]},{"url":"https://www.elastic.co/community/security","tags":["x_transferred","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-31421","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4x46-8gg7-f9vx"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/31xxx/CVE-2023-31421.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-31421","title":"Beats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issue","description":"It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether the server certificate is valid for the target IP address; however, certificate signature validation is still performed. More specifically, when the client is configured to connect to an IP address (instead of a hostname) it does not validate the server certificate's IP SAN values against that IP address and certificate validation fails, and therefore the connection is not blocked as expected.","status":"published","published":"2023-10-26T03:10:52.684Z","modified":"2024-08-02T14:53:30.714Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:35:27.430605Z"}],"euvd":[{"id":"EUVD-2023-35729","description":"It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether the server certificate is valid for the target IP address; however, certificate signature validation is still performed. More specifically, when the client is configured to connect to an IP address (instead of a hostname) it does not validate the server certificate's IP SAN values against that IP address and certificate validation fails, and therefore the connection is not blocked as expected.","status":"published","published":"2023-10-26T03:10:52Z","modified":"2024-08-02T14:53:30Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T03:50:05.51254Z"}],"ghsa":[{"id":"GHSA-4x46-8gg7-f9vx","title":"It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet...","description":"It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether the server certificate is valid for the target IP address; however, certificate signature validation is still performed. More specifically, when the client is configured to connect to an IP address (instead of a hostname) it does not validate the server certificate's IP SAN values against that IP address and certificate validation fails, and therefore the connection is not blocked as expected.","status":"published","published":"2023-10-26T06:30:25Z","modified":"2023-11-08T15:30:33Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:54:55.524004Z"}],"nvd":[{"id":"CVE-2023-31421","description":"It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether the server certificate is valid for the target IP address; however, certificate signature validation is still performed. More specifically, when the client is configured to connect to an IP address (instead of a hostname) it does not validate the server certificate's IP SAN values against that IP address and certificate validation fails, and therefore the connection is not blocked as expected.","status":"published","published":"2023-10-26T04:15:16Z","modified":"2026-06-17T05:56:54.707Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:08:40.004465Z"}],"osv":[{"id":"CVE-2023-31421","title":"Beats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issue","description":"It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether the server certificate is valid for the target IP address; however, certificate signature validation is still performed. More specifically, when the client is configured to connect to an IP address (instead of a hostname) it does not validate the server certificate's IP SAN values against that IP address and certificate validation fails, and therefore the connection is not blocked as expected.","status":"published","published":"2023-10-26T03:10:52.684Z","modified":"2026-10-28T02:30:47.09673516Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:44:31.790231Z"}]}}