CVE-2025-35434
CISA Thorium does not validate TLS connections to Elasticsearch
Summary
CISA Thorium does not validate TLS connections to Elasticsearch
Original description
The description as published by the source.
CISA Thorium does not validate TLS certificates when connecting to Elasticsearch. An unauthenticated attacker with access to a Thorium cluster could impersonate the Elasticsearch service. Fixed in 1.1.2.
References
- advisory github.com
- advisory nvd.nist.gov
- web github.com
- web github.com
- web raw.githubusercontent.com
- web cve.org