CVE-2025-37727Medium· 5.7▾ SunlitInsertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/opera…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 31.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex
elasticsearch >= 7.0.0, <= 7.17.29elasticsearch >= 8.0.0, < 8.18.8elasticsearch >= 8.19.0, < 8.19.5elasticsearch >= 9.0.0, < 9.0.8elasticsearch >= 9.1.0, < 9.1.5Upgrade past the affected range:
elasticsearch 9.1.5Affected packages:
org.elasticsearch.plugin:reindex-client >= 7.0.0, < 8.18.8org.elasticsearch.plugin:reindex-client >= 8.19.0, < 8.19.5org.elasticsearch.plugin:reindex-client >= 9.0.0-beta1, < 9.0.8org.elasticsearch.plugin:reindex-client >= 9.1.0, < 9.1.5Patched in:
org.elasticsearch.plugin:reindex-client 8.18.8org.elasticsearch.plugin:reindex-client 8.19.5org.elasticsearch.plugin:reindex-client 9.0.8org.elasticsearch.plugin:reindex-client 9.1.5Connected by shared product, vendor, weakness, or advisory.
CVE-2025-37731Medium· 6.8Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates
CVE-2026-103006Medium· 6.5Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API
CVE-2026-103008Medium· 6.5Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth
CVE-2026-103009High· 7.1Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier
CVE-2026-102408Medium· 4.3Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492)
CVE-2026-103005Medium· 6.5Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130)