CVE-2025-35434 CISA Thorium does not validate TLS connections to Elasticsearch
An attacker can impersonate the Elasticsearch service by bypassing TLS validation, potentially intercepting or modifying data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-35434?
CVE-2025-35434 is a low-severity vulnerability in CISA Thorium, published on 17 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
CISA Thorium does not validate TLS certificates when connecting to Elasticsearch. An unauthenticated attacker with access to a Thorium cluster could impersonate the Elasticsearch service. Fixed in 1.1.2.
Weakness: CWE-295
Which versions are affected by CVE-2025-35434?
It affects 1 product.
Products include Cisa Thorium.
How do I fix CVE-2025-35434?
No fix has been published for CVE-2025-35434 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-35434 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-35434 exists.
Other vulnerabilities in CISA Thorium
- CVE-2025-35432 CISA Thorium does not rate limit account verification email messages
- CVE-2025-35436 CISA Thorium account verification email error handling
- CVE-2025-35430 CISA Thorium insecure downloaded file path validation
- CVE-2025-35431 CISA Thorium LDAP injection
- CVE-2025-35435 CISA Thorium download stream divide by zero
Sources
Also known as GHSA-r8gr-36v8-m732.