---
id: CVE-2025-37727
title: >-
  Insertion of sensitive information in log file in Elasticsearch can lead to
  loss of confidentiality under specific preconditions when auditing requests to
  the  reindex API
  https://www.elastic.co/docs/api/doc/elasticsearch/operation/opera…
summary: >-
  Insertion of sensitive information in log file in Elasticsearch can lead to
  loss of confidentiality under specific preconditions when auditing requests to
  the  reindex API
  https://www.elastic.co/docs/api/doc/elasticsearch/operation/opera…
severity: medium
cvss: 5.7
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-532
vendor: elastic
product: elasticsearch
affected:
  - 'elasticsearch >= 7.0.0, <= 7.17.29'
  - 'elasticsearch >= 8.0.0, < 8.18.8'
  - 'elasticsearch >= 8.19.0, < 8.19.5'
  - 'elasticsearch >= 9.0.0, < 9.0.8'
  - 'elasticsearch >= 9.1.0, < 9.1.5'
patched:
  - elasticsearch 9.1.5
published: '2025-10-10'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T13:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-37727'
references:
  - url: >-
      https://discuss.elastic.co/t/elasticsearch-8-18-8-8-19-5-9-0-8-9-1-5-security-update-esa-2025-18/382453
    label: security@elastic.co
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-37727'
  - url: >-
      https://github.com/elastic/elasticsearch/commit/e982eef416a5e1c2a4e94236d7d3b33b5c8d07db
  - url: >-
      https://www.elastic.co/guide/en/elasticsearch/reference/8.18/release-notes-8.18.8.html
  - url: >-
      https://github.com/elastic/elasticsearch/commit/0b876b816544ff5ed07fc9d67cc584b58241e116
  - url: 'https://github.com/advisories/GHSA-56r7-h6mw-rcfv'
tags:
  - nvd
  - ghsa
  - maven
epss: 0.00247
epssPercentile: 0.15918
aliases:
  - GHSA-56r7-h6mw-rcfv
ecosystem: maven
ingestedAt: '2026-09-29T21:49:08.219Z'
---

## Overview

Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the  reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex

## Affected

- `elasticsearch >= 7.0.0, <= 7.17.29`
- `elasticsearch >= 8.0.0, < 8.18.8`
- `elasticsearch >= 8.19.0, < 8.19.5`
- `elasticsearch >= 9.0.0, < 9.0.8`
- `elasticsearch >= 9.1.0, < 9.1.5`

## Remediation

Upgrade past the affected range:

- `elasticsearch 9.1.5`

## Package advisory (CVE-2025-37727)

Affected packages:

- `org.elasticsearch.plugin:reindex-client >= 7.0.0, < 8.18.8`
- `org.elasticsearch.plugin:reindex-client >= 8.19.0, < 8.19.5`
- `org.elasticsearch.plugin:reindex-client >= 9.0.0-beta1, < 9.0.8`
- `org.elasticsearch.plugin:reindex-client >= 9.1.0, < 9.1.5`

Patched in:

- `org.elasticsearch.plugin:reindex-client 8.18.8`
- `org.elasticsearch.plugin:reindex-client 8.19.5`
- `org.elasticsearch.plugin:reindex-client 9.0.8`
- `org.elasticsearch.plugin:reindex-client 9.1.5`

Source: https://github.com/advisories/GHSA-56r7-h6mw-rcfv