medium5.7
CVE-2025-37727
Elasticsearch: Insertion of Sensitive Information into Log File via reindex API
Impact
Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.elasticsearch.plugin:reindex-client | >= 7.0.0, < 8.18.8 | 8.18.8 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Elastic | Elasticsearch | from 7.0.0 through 7.17.29 from 8.0.0 before 8.18.8 from 8.19.0 before 8.19.5 from 9.0.0 before 9.0.8 from 9.1.0 before 9.1.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://discuss.elastic.co/t/elasticsearch-8-18-8-8-19-5-9-0-8-9-1-5-security-update-esa-2025-18/382453
- https://github.com/advisories/GHSA-56r7-h6mw-rcfv
- https://nvd.nist.gov/vuln/detail/CVE-2025-37727
- https://github.com/elastic/elasticsearch/commit/e982eef416a5e1c2a4e94236d7d3b33b5c8d07db
- https://www.elastic.co/guide/en/elasticsearch/reference/8.18/release-notes-8.18.8.html
- https://github.com/elastic/elasticsearch/commit/0b876b816544ff5ed07fc9d67cc584b58241e116