All vulnerabilities
CVE-2025-37727BIT-elasticsearch-2025-37727GHSA-56r7-h6mw-rcfv

org.elasticsearch.plugin:reindex-client: Elasticsearch: Insertion of Sensitive Information into Log File via reindex API

Elastic org.elasticsearch.plugin:reindex-clientmavenDatabases
Open in ThreatlineRecord JSON
CVSS
5.7Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.25%Chance of exploitation activity in the next 30 days, higher than 15% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in8.18.8Also 8.19.5, 9.0.8 and 1 moreGitHub
Published10 Oct 2025Updated 29 Sep 2026CVE List

What fixes it

  • 8.18.8org.elasticsearch.plugin:reindex-client, mavenGitHub<dependency><groupId>org.elasticsearch.plugin</groupId><artifactId>reindex-client</artifactId><version>8.18.8</version></dependency>
  • 8.19.5org.elasticsearch.plugin:reindex-client, mavenGitHub<dependency><groupId>org.elasticsearch.plugin</groupId><artifactId>reindex-client</artifactId><version>8.19.5</version></dependency>
  • 9.0.8org.elasticsearch.plugin:reindex-client, mavenGitHub<dependency><groupId>org.elasticsearch.plugin</groupId><artifactId>reindex-client</artifactId><version>9.0.8</version></dependency>
  • 9.1.5org.elasticsearch.plugin:reindex-client, mavenGitHub<dependency><groupId>org.elasticsearch.plugin</groupId><artifactId>reindex-client</artifactId><version>9.1.5</version></dependency>
  • 8.18.8org.elasticsearch.plugin:reindex-client, MavenOSV<dependency><groupId>org.elasticsearch.plugin</groupId><artifactId>reindex-client</artifactId><version>8.18.8</version></dependency>
  • 8.19.5org.elasticsearch.plugin:reindex-client, MavenOSV<dependency><groupId>org.elasticsearch.plugin</groupId><artifactId>reindex-client</artifactId><version>8.19.5</version></dependency>
Show all 8 fixed versions
  • 9.0.8org.elasticsearch.plugin:reindex-client, MavenOSV<dependency><groupId>org.elasticsearch.plugin</groupId><artifactId>reindex-client</artifactId><version>9.0.8</version></dependency>
  • 9.1.5org.elasticsearch.plugin:reindex-client, MavenOSV<dependency><groupId>org.elasticsearch.plugin</groupId><artifactId>reindex-client</artifactId><version>9.1.5</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex

Text from CVE List

Affected versions 63

  • org.elasticsearch.plugin:reindex-client, maven>= 7.0.0, < 8.18.8GitHub
  • org.elasticsearch.plugin:reindex-client, maven>= 8.19.0, < 8.19.5GitHub
  • org.elasticsearch.plugin:reindex-client, maven>= 9.0.0-beta1, < 9.0.8GitHub
  • org.elasticsearch.plugin:reindex-client, maven>= 9.1.0, < 9.1.5GitHub
  • Elasticsearchaffected: 7.0.0 through 7.17.29CVE List
  • Elasticsearchaffected: 8.0.0 through 8.18.7CVE List
  • Elasticsearchaffected: 8.19.0 through 8.19.4CVE List
  • Elasticsearchaffected: 9.0.0 through 9.0.7CVE List
  • Elasticsearchaffected: 9.1.0 through 9.1.4CVE List
  • org.elasticsearch.plugin:reindex-client, Mavenfrom 7.0.0, fixed in 8.18.8OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.0.0OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.0.1OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.1.0OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.1.1OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.10.0OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.10.1OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.10.2OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.11.0OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.11.1OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.11.2OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.12.0OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.12.1OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.13.0OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.13.1OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.13.2OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.13.3OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.13.4OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.14.0OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.14.1OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.14.2OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.15.0OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.15.1OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.15.2OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.16.0OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.16.1OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.16.2OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.16.3OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.17.0OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.17.1OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.17.10OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.17.11OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.17.12OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.17.13OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.17.14OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.17.15OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.17.16OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.17.17OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.17.18OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.17.19OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.17.2OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.17.20OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.17.21OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.17.22OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.17.23OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.17.24OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.17.25OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.17.26OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.17.27OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.17.28OSV
  • org.elasticsearch.plugin:reindex-client, Maven7.17.29OSV
  • org.elasticsearch.plugin:reindex-client, Mavenfrom 8.19.0, fixed in 8.19.5OSV
  • org.elasticsearch.plugin:reindex-client, Mavenfrom 9.0.0-beta1, fixed in 9.0.8OSV
  • org.elasticsearch.plugin:reindex-client, Mavenfrom 9.1.0, fixed in 9.1.5OSV

References 6