Elasticsearch CVE-2025-37727

Exploitation requires that Elasticsearch audit logging is enabled AND configured to log requests to the reindex API (https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex); under those conditions sensitive information is inserted into the audit log file. Limiting factors are significant: this is non-default behavior (auditing must be explicitly turned on), the attacker needs adjacent-network access rather than arbitrary Internet reachability (AV:A), and must already be an authenticated low-privilege actor (PR:L) able to read the audit logs. There is no impact to integrity or availability (I:N/A:N) - confidentiality only.

This is a genuine but modest-priority issue, not a high-severity emergency. The vendor-assigned CVSS of 5.7 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects a confidentiality-only information-disclosure flaw (CWE-532) that is bounded by two meaningful limiters: it requires Adjacent (AV:A) access rather than full Internet reachability, and it requires an authenticated low-privilege actor (PR:L). All exploitation-pressure signals point downward and agree with each other: EPSS is only 0.25% (15th percentile), the CVE is NOT in CISA KEV, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis. The C:H rating is notable but context-dependent: it only materializes under 'specific preconditions when auditing requests to the reindex API,' meaning audit logging must be enabled and capturing reindex calls, so the practical impact is narrower than the raw C:H suggests. One point to verify with the vendor: the official ESA-2025-18 advisory should be consulted to confirm the exact fixed versions and the precise audit configuration that triggers the leak, since the NVD CPE entries are wildcarded (version-unspecified) and do not themselves identify the vulnerable range. No signals are conflicting; they consistently indicate a low-to-moderate, condition-gated risk rather than a widespread exploitation threat.

An Elasticsearch cluster has request auditing enabled on an operator who then calls the reindex API; sensitive information (such as credentials used for remote/cross-cluster reindex operations) is written into the audit log. A low-privileged but authenticated actor with adjacent-network access to those logs then reads the sensitive data from the log file. No public exploit code exists, and exploitation depends on audit logging being configured to capture reindex requests.