{"id":"CVE-2025-37727","title":"Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the  reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/opera…","summary":"Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the  reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/opera…","severity":"medium","cvss":5.7,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-532"],"vendor":"elastic","product":"elasticsearch","affected":["elasticsearch >= 7.0.0, <= 7.17.29","elasticsearch >= 8.0.0, < 8.18.8","elasticsearch >= 8.19.0, < 8.19.5","elasticsearch >= 9.0.0, < 9.0.8","elasticsearch >= 9.1.0, < 9.1.5"],"patched":["elasticsearch 9.1.5"],"published":"2025-10-10","updated":"2026-10-08","sourceUpdated":"2026-10-08T13:10:00.200","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-37727","references":[{"url":"https://discuss.elastic.co/t/elasticsearch-8-18-8-8-19-5-9-0-8-9-1-5-security-update-esa-2025-18/382453","label":"security@elastic.co"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37727"},{"url":"https://github.com/elastic/elasticsearch/commit/e982eef416a5e1c2a4e94236d7d3b33b5c8d07db"},{"url":"https://www.elastic.co/guide/en/elasticsearch/reference/8.18/release-notes-8.18.8.html"},{"url":"https://github.com/elastic/elasticsearch/commit/0b876b816544ff5ed07fc9d67cc584b58241e116"},{"url":"https://github.com/advisories/GHSA-56r7-h6mw-rcfv"}],"tags":["nvd","ghsa","maven"],"epss":0.00247,"epssPercentile":0.15918,"aliases":["GHSA-56r7-h6mw-rcfv"],"ecosystem":"maven","ingestedAt":"2026-09-29T21:49:08.219Z","slug":"CVE-2025-37727","body":"## Overview\n\nInsertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the  reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex\n\n## Affected\n\n- `elasticsearch >= 7.0.0, <= 7.17.29`\n- `elasticsearch >= 8.0.0, < 8.18.8`\n- `elasticsearch >= 8.19.0, < 8.19.5`\n- `elasticsearch >= 9.0.0, < 9.0.8`\n- `elasticsearch >= 9.1.0, < 9.1.5`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `elasticsearch 9.1.5`\n\n## Package advisory (CVE-2025-37727)\n\nAffected packages:\n\n- `org.elasticsearch.plugin:reindex-client >= 7.0.0, < 8.18.8`\n- `org.elasticsearch.plugin:reindex-client >= 8.19.0, < 8.19.5`\n- `org.elasticsearch.plugin:reindex-client >= 9.0.0-beta1, < 9.0.8`\n- `org.elasticsearch.plugin:reindex-client >= 9.1.0, < 9.1.5`\n\nPatched in:\n\n- `org.elasticsearch.plugin:reindex-client 8.18.8`\n- `org.elasticsearch.plugin:reindex-client 8.19.5`\n- `org.elasticsearch.plugin:reindex-client 9.0.8`\n- `org.elasticsearch.plugin:reindex-client 9.1.5`\n\nSource: https://github.com/advisories/GHSA-56r7-h6mw-rcfv","depth":"sunlit","depthScore":31,"depthScoreParts":{"impact":31.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}