Inclusion of Sensitive Information in Log Files in Elasticsearch - CVE-2025-37727
Published: October 6, 2025
Vulnerability identifier: #VU116631
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-37727
CWE-ID: CWE-532
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to software stores sensitive information into log files when auditing requests to the reindex API. A remote user can read the log files and gain access to sensitive data.
Affected software
Elasticsearch
IBM Watson Discovery for IBM Cloud Pak for Data
Splunk AppDynamics Analytics Agent
IBM Watson Discovery for IBM Cloud Pak for Data
Splunk AppDynamics Analytics Agent
How to mitigate CVE-2025-37727
Install updates from vendor's website.
Elasticsearch - addressed in versions 8.18.8, 8.19.5, 9.0.8, 9.1.5
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.1
Splunk AppDynamics Analytics Agent - update to 26.1.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.1
Splunk AppDynamics Analytics Agent - update to 26.1.0