Elasticsearch maintainers released a security update (ESA‑2025‑27) on December 15, 2025 that fixes CVE‑2025‑37731 — an Improper Authentication bug in Elasticsearch’s PKI realm that can allow user impersonation when specially crafted client certificates are presented and accepted by the server...