{"id":"CVE-2025-37727","aliases":["BIT-elasticsearch-2025-37727","EUVD-2025-33703","GHSA-56r7-h6mw-rcfv","ROOT-APP-MAVEN-CVE-2025-37727","UBUNTU-CVE-2025-37727"],"status":"published","title":"Elasticsearch Insertion of sensitive information in log file","description":"Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the  reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex","severity":{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00253,"percentile":0.16884,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2025-10-10T09:56:15Z","modified":"2026-10-28T10:45:26Z","fixes":[{"ecosystem":"Maven","package":"org.elasticsearch.plugin:reindex-client","fixed_in":["8.18.8","8.19.5","9.0.8","9.1.5"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"elasticsearch","fixed_in":["8.18.8","8.19.5","9.0.8","9.1.5"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.elasticsearch:elasticsearch","fixed_in":["9.1.3-root.io.2","9.1.3-root.io.3"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.elasticsearch:elasticsearch","fixed_in":["9.1.3-aikido.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.elasticsearch.plugin:reindex-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"8.18.8"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.elasticsearch.plugin:reindex-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.19.0"},{"fixed":"8.19.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.elasticsearch.plugin:reindex-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-beta1"},{"fixed":"9.0.8"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.elasticsearch.plugin:reindex-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1.0"},{"fixed":"9.1.5"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"elasticsearch","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.18.8"},{"introduced":"8.19.0"},{"fixed":"8.19.5"},{"introduced":"9.0.0"},{"fixed":"9.0.8"},{"introduced":"9.1.0"},{"fixed":"9.1.5"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.elasticsearch.plugin:reindex-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"8.18.8"}]}],"versions":["7.0.0","7.0.1","7.1.0","7.1.1","7.10.0","7.10.1","7.10.2","7.11.0","7.11.1","7.11.2","7.12.0","7.12.1","7.13.0","7.13.1","7.13.2","7.13.3","7.13.4","7.14.0","7.14.1","7.14.2","7.15.0","7.15.1","7.15.2","7.16.0","7.16.1","7.16.2","7.16.3","7.17.0","7.17.1","7.17.10","7.17.11","7.17.12","7.17.13","7.17.14","7.17.15","7.17.16","7.17.17","7.17.18","7.17.19","7.17.2","7.17.20","7.17.21","7.17.22","7.17.23","7.17.24","7.17.25","7.17.26","7.17.27","7.17.28","7.17.29","7.17.3","7.17.4","7.17.5","7.17.6","7.17.7","7.17.8","7.17.9","7.2.0","7.2.1","7.3.0","7.3.1","7.3.2","7.4.0","7.4.1","7.4.2","7.5.0","7.5.1","7.5.2","7.6.0","7.6.1","7.6.2","7.7.0","7.7.1","7.8.0","7.8.1","7.9.0","7.9.1","7.9.2","7.9.3"]},{"source":"osv","ecosystem":"Maven","package":"org.elasticsearch.plugin:reindex-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.19.0"},{"fixed":"8.19.5"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.elasticsearch.plugin:reindex-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-beta1"},{"fixed":"9.0.8"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.elasticsearch.plugin:reindex-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1.0"},{"fixed":"9.1.5"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.elasticsearch:elasticsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.3-root.io.2"},{"fixed":"9.1.3-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.elasticsearch:elasticsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.3-aikido.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"elasticsearch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.2+dfsg-1","1.7.3+dfsg-1","1.7.3+dfsg-2","1.7.3+dfsg-3"]}],"products":[{"vendor":"elastic","product":"elasticsearch"}],"references":[{"url":"https://discuss.elastic.co/t/elasticsearch-8-18-8-8-19-5-9-0-8-9-1-5-security-update-esa-2025-18/382453","tags":["Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37727","tags":["web","advisory"]},{"url":"https://github.com/elastic/elasticsearch/commit/e982eef416a5e1c2a4e94236d7d3b33b5c8d07db","tags":["web"]},{"url":"https://www.elastic.co/guide/en/elasticsearch/reference/8.18/release-notes-8.18.8.html","tags":["web"]},{"url":"https://github.com/elastic/elasticsearch/commit/0b876b816544ff5ed07fc9d67cc584b58241e116","tags":["web"]},{"url":"https://github.com/advisories/GHSA-56r7-h6mw-rcfv"},{"url":"https://github.com/elasticsearch","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37727.json","tags":["advisory"]},{"url":"https://github.com/elastic/elasticsearch","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2025-37727","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-37727","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-37727","title":"Elasticsearch Insertion of sensitive information in log file","description":"Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the  reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex","status":"published","published":"2025-10-10T09:56:15.234Z","modified":"2025-10-10T16:34:36.812Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:32:29.607786Z"}],"euvd":[{"id":"EUVD-2025-33703","description":"Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the  reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex","status":"published","published":"2025-10-10T09:56:15Z","modified":"2025-10-10T16:34:36Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:31:33.954405Z"}],"ghsa":[{"id":"GHSA-56r7-h6mw-rcfv","title":"Elasticsearch: Insertion of Sensitive Information into Log File via reindex API","description":"Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the  reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex","status":"published","published":"2025-10-10T12:30:55Z","modified":"2026-09-29T21:29:10Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:41:22.654187Z"}],"nvd":[{"id":"CVE-2025-37727","description":"Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the  reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex","status":"published","published":"2025-10-10T10:15:34.167Z","modified":"2026-10-08T13:10:00.2Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:11:36.851295Z"}],"osv":[{"id":"CVE-2025-37727","title":"Elasticsearch Insertion of sensitive information in log file","description":"Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the  reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex","status":"published","published":"2025-10-10T09:56:15.234Z","modified":"2026-10-28T10:45:26.250027048Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:44:48.342824Z"},{"id":"GHSA-56r7-h6mw-rcfv","title":"Elasticsearch: Insertion of Sensitive Information into Log File via reindex API","description":"Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the  reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex","status":"published","published":"2025-10-10T12:30:55Z","modified":"2026-09-29T21:45:13.828321696Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"ROOT-APP-MAVEN-CVE-2025-37727","title":"CVE-2025-37727 in io.root.org.elasticsearch:elasticsearch - Patched by Root","description":"Root has patched CVE-2025-37727 in the io.root.org.elasticsearch:elasticsearch package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-06-17T18:05:57Z","modified":"2026-06-18T00:45:06.251691289Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"UBUNTU-CVE-2025-37727","description":"Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the  reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex","status":"published","published":"2025-10-10T10:15:00Z","modified":"2025-10-24T05:18:12Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:28.829873Z"},{"id":"BIT-elasticsearch-2025-37727","title":"Elasticsearch Insertion of sensitive information in log file","description":"Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the  reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex","status":"published","published":"2025-10-14T08:39:50.514Z","modified":"2026-09-08T08:47:25.196288799Z","updated_at":"2026-11-02T15:28:29.563843Z"}]}}