CVE-2025-37727 MEDIUM

CVE-2025-37727: Elasticsearch Insertion of sensitive information in log file

Vendor Elastic
Product Elasticsearch
Weakness CWE-532 · Sensitive info in logs
Published October 10, 2025
Last update October 10, 2025
View on NVD All CVEs

CVSS base score

5.7/10
Attack vector Adjacent
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex

Key dates

02Disclosure timeline

October 10, 2025 CVE published
October 10, 2025 Record updated