CVE-2025-35434 is a medium severity flaw (CVSS 4.2) in CISA Thorium, a malware analysis framework. Thorium does not validate TLS certificates when it connects to Elasticsearch, so someone with access to the cluster could impersonate the Elasticsearch service. It is fixed in version 1.1.2.
What's affected
The record says CISA Thorium does not validate TLS certificates when connecting to Elasticsearch and that the fix is in 1.1.2. The CISA advisory VA-25-259-01 covers several Thorium issues and says they were addressed in 1.1.2 and in specific commits on the main branch.
The advisory lists this CVE alongside others in the same release train, some fixed in 1.1.1 and some in 1.1.2. If you are on 1.1.1, you still need 1.1.2 for this one. The record links to the source file that sets up the Elasticsearch client and to the 1.1.2 release.
How to check if you're exposed
Check which Thorium version you run. For a source based deployment, look at the release tag or commit you built from. For container deployments, check the image tag.
Then check where Elasticsearch sits relative to Thorium. The exposure needs an attacker who has access to the cluster network. If Elasticsearch and Thorium share a flat network with other workloads, the risk is higher. You can also run the free in-browser dependency scan at gold.safeguard.sh/scan and browse the Gold directory for related advisories.
What to do now
- Upgrade Thorium to 1.1.2 or later, using the project release notes.
- Verify the deployed version after the upgrade.
- Restrict network access to Elasticsearch so only Thorium components can reach it.
- Use certificates issued by a CA you control for Elasticsearch, so validation has something to check.
- Read the other CVEs in the CISA advisory and confirm each one is covered by your version.
Why it matters
The weakness is CWE-295, improper certificate validation. TLS gives you encryption and also proves who you are talking to. If the client skips the identity check, the encryption still works, but it may be going to the wrong party.
A fake Elasticsearch service could receive data that Thorium sends, or return false results. In a malware analysis system, the integrity of stored results matters as much as secrecy. The attacker needs network position inside the cluster, which keeps the score at medium. The CVE is not on the CISA Known Exploited Vulnerabilities list and the record does not report exploitation.
Many internal services skip certificate checks for convenience. Dependency inventory helps you find which of your tools do.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is 1.1.1 enough?
No for this CVE. The advisory lists the Elasticsearch certificate fix in 1.1.2.
Who can exploit this?
The record describes an unauthenticated attacker with access to a Thorium cluster who could impersonate the Elasticsearch service.
Sources
Last reviewed: 18 October 2026.
