PT-2025-41309 · Elastic · Elasticsearch

Ismisepaul + 1 · Published 2025-10-08 · Updated 2026-04-28 · CVE-2025-37727

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Elasticsearch versions 8.18.8, 8.19.5, 9.0.8, and 9.1.5

Description A flaw exists in Elasticsearch where the insertion of sensitive information into log files can result in a loss of confidentiality under certain conditions. This occurs specifically when auditing requests to the reindex API.

Recommendations Update to Elasticsearch version 8.18.9 or later. Update to Elasticsearch version 8.19.6 or later. Update to Elasticsearch version 9.0.9 or later. Update to Elasticsearch version 9.1.6 or later.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BIT-ELASTICSEARCH-2025-37727

CVE-2025-37727

ECHO-5478-882B-E488

GHSA-56R7-H6MW-RCFV

Affected Products

Elasticsearch

References · 20

• https://nvd.nist.gov/vuln/detail/CVE-2025-37727 · Security Note
• https://osv.dev/vulnerability/GHSA-56r7-h6mw-rcfv · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2025-37727 · Vendor Advisory
• https://discuss.elastic.co/t/elasticsearch-8-18-8-8-19-5-9-0-8-9-1-5-security-update-esa-2025-18/382453 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-37727 · Security Note
• https://osv.dev/vulnerability/BIT-elasticsearch-2025-37727 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-37727 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-37727 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-37727 · Vendor Advisory
• https://github.com/elastic/elasticsearch · Note
• https://github.com/elastic/elasticsearch/commit/e982eef416a5e1c2a4e94236d7d3b33b5c8d07db · Note
• https://twitter.com/Hossted_OSS/status/1980182611671625867 · Twitter Post
• https://t.me/cveNotify/146684 · Telegram Post
• https://t.me/CVEtracker/34562 · Telegram Post
• https://elastic.co/guide/en/elasticsearch/reference/8.18/release-notes-8.18.8.html · Note