{"id":"GHSA-56r7-h6mw-rcfv","summary":"Elasticsearch: Insertion of Sensitive Information into Log File via reindex API","details":"Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the  reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex","aliases":["BIT-elasticsearch-2025-37727","CVE-2025-37727"],"modified":"2026-09-29T21:45:07.723708594Z","published":"2025-10-10T12:30:55Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2025-10-11T00:13:33Z","nvd_published_at":"2025-10-10T10:15:34Z","cwe_ids":["CWE-532"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-37727"},{"type":"WEB","url":"https://github.com/elastic/elasticsearch/commit/0b876b816544ff5ed07fc9d67cc584b58241e116"},{"type":"WEB","url":"https://github.com/elastic/elasticsearch/commit/e982eef416a5e1c2a4e94236d7d3b33b5c8d07db"},{"type":"WEB","url":"https://discuss.elastic.co/t/elasticsearch-8-18-8-8-19-5-9-0-8-9-1-5-security-update-esa-2025-18/382453"},{"type":"PACKAGE","url":"https://github.com/elastic/elasticsearch"},{"type":"WEB","url":"https://www.elastic.co/guide/en/elasticsearch/reference/8.18/release-notes-8.18.8.html"}],"affected":[{"package":{"name":"org.elasticsearch.plugin:reindex-client","ecosystem":"Maven","purl":"pkg:maven/org.elasticsearch.plugin/reindex-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"8.18.8"}]}],"versions":["7.0.0","7.0.1","7.1.0","7.1.1","7.10.0","7.10.1","7.10.2","7.11.0","7.11.1","7.11.2","7.12.0","7.12.1","7.13.0","7.13.1","7.13.2","7.13.3","7.13.4","7.14.0","7.14.1","7.14.2","7.15.0","7.15.1","7.15.2","7.16.0","7.16.1","7.16.2","7.16.3","7.17.0","7.17.1","7.17.10","7.17.11","7.17.12","7.17.13","7.17.14","7.17.15","7.17.16","7.17.17","7.17.18","7.17.19","7.17.2","7.17.20","7.17.21","7.17.22","7.17.23","7.17.24","7.17.25","7.17.26","7.17.27","7.17.28","7.17.29","7.17.3","7.17.4","7.17.5","7.17.6","7.17.7","7.17.8","7.17.9","7.2.0","7.2.1","7.3.0","7.3.1","7.3.2","7.4.0","7.4.1","7.4.2","7.5.0","7.5.1","7.5.2","7.6.0","7.6.1","7.6.2","7.7.0","7.7.1","7.8.0","7.8.1","7.9.0","7.9.1","7.9.2","7.9.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-56r7-h6mw-rcfv/GHSA-56r7-h6mw-rcfv.json"}},{"package":{"name":"org.elasticsearch.plugin:reindex-client","ecosystem":"Maven","purl":"pkg:maven/org.elasticsearch.plugin/reindex-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.19.0"},{"fixed":"8.19.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-56r7-h6mw-rcfv/GHSA-56r7-h6mw-rcfv.json"}},{"package":{"name":"org.elasticsearch.plugin:reindex-client","ecosystem":"Maven","purl":"pkg:maven/org.elasticsearch.plugin/reindex-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0-beta1"},{"fixed":"9.0.8"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-56r7-h6mw-rcfv/GHSA-56r7-h6mw-rcfv.json"}},{"package":{"name":"org.elasticsearch.plugin:reindex-client","ecosystem":"Maven","purl":"pkg:maven/org.elasticsearch.plugin/reindex-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1.0"},{"fixed":"9.1.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-56r7-h6mw-rcfv/GHSA-56r7-h6mw-rcfv.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}]}