CVE-2025-37727
Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex
- CVSS 3.1
- 5.7
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-25)
- CWE
- CWE-532
- Published
- Modified
- Record from
- the NVD, synced
Affected
- elastic:elasticsearch
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-56r7-h6mw-rcfv | Maven | org.elasticsearch.plugin:reindex-client | >=7.0.0 <8.18.8 | 8.18.8 |
| GHSA-56r7-h6mw-rcfv | Maven | org.elasticsearch.plugin:reindex-client | >=8.19.0 <8.19.5 | 8.19.5 |
| GHSA-56r7-h6mw-rcfv | Maven | org.elasticsearch.plugin:reindex-client | >=9.0.0-beta1 <9.0.8 | 9.0.8 |
| GHSA-56r7-h6mw-rcfv | Maven | org.elasticsearch.plugin:reindex-client | >=9.1.0 <9.1.5 | 9.1.5 |