AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

ElasticsearchGHSA-56r7-h6mw-rcfv

Elasticsearch: Insertion of Sensitive Information into Log File via reindex API

Elasticsearch

CVE-2025-37727 · Published Oct 10, 2025 · updated Sep 10, 2026

Medium5.7
Fix: upgrade to 8.18.8 or later (4 fixed versions below)
GitHub advisory

Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex

Affected versions

PackageAffectedFixed in
org.elasticsearch:elasticsearch
Maven
>= 7.0.0, < 8.18.88.18.8
>= 8.19.0, < 8.19.58.19.5
>= 9.0.0-beta1, < 9.0.89.0.8
>= 9.1.0, < 9.1.59.1.5
Details and references
CVSS 3.1
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-532
Also known as
BIT-elasticsearch-2025-37727, CVE-2025-37727

More Elasticsearch advisories

All Elasticsearch
Medium 6.8Dec 15, 2025Elasticsearch: improper authenticationCVE-2025-37731fixed in 8.19.8 +2Medium 6.5May 1, 2025Elasticsearch Uncontrolled Resource Consumption VulnerabilityCVE-2024-52979fixed in 7.17.25 +1Medium 4.9Apr 8, 2025Elasticsearch Vulnerable to Stack Overflow due to a Large RecursionCVE-2024-52981fixed in 7.17.24 +1Medium 6.5Apr 8, 2025Elasticsearch Potential Node Crash due to Large Recursion in `innerForbidCircularReferences` FunctionCVE-2024-52980fixed in 8.15.1Medium 6.5Jan 21, 2025Elasticsearch allocation of resources without limits or throttling leads to crashCVE-2024-43709fixed in 7.17.21 +1MediumDec 17, 2024Elasticsearch Incorrect Authorization vulnerabilityCVE-2024-12539fixed in 8.16.2