GHSA-56r7-h6mw-rcfv

Source

https://github.com/advisories/GHSA-56r7-h6mw-rcfv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-56r7-h6mw-rcfv/GHSA-56r7-h6mw-rcfv.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-56r7-h6mw-rcfv

Aliases

Downstream

CGA (42)

ECHO (1)

ECHO-5478-882b-e488

MINI (15)

Published

2025-10-10T12:30:55Z

Modified

2026-09-29T21:45:13Z

Severity

5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Elasticsearch: Insertion of Sensitive Information into Log File via reindex API

Details

Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex

Database specific

{
    "cwe_ids":  [
        "CWE-532"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-10-11T00:13:33Z",
    "nvd_published_at":  "2025-10-10T10:15:34Z",
    "severity":  "MODERATE"
}

References

Affected packages

Maven

org.elasticsearch.plugin:reindex-client

Package

Name: org.elasticsearch.plugin:reindex-client; View open source insights on deps.dev
Purl: pkg:maven/org.elasticsearch.plugin/reindex-client

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.0.0

Fixed

8.18.8

Affected versions

7.*

7.0.0

7.0.1

7.1.0

7.1.1

7.2.0

7.2.1

7.3.0

7.3.1

7.3.2

7.4.0

7.4.1

7.4.2

7.5.0

7.5.1

7.5.2

7.6.0

7.6.1

7.6.2

7.7.0

7.7.1

7.8.0

7.8.1

7.9.0

7.9.1

7.9.2

7.9.3

7.10.0

7.10.1

7.10.2

7.11.0

7.11.1

7.11.2

7.12.0

7.12.1

7.13.0

7.13.1

7.13.2

7.13.3

7.13.4

7.14.0

7.14.1

7.14.2

7.15.0

7.15.1

7.15.2

7.16.0

7.16.1

7.16.2

7.16.3

7.17.0

7.17.1

7.17.2

7.17.3

7.17.4

7.17.5

7.17.6

7.17.7

7.17.8

7.17.9

7.17.10

7.17.11

7.17.12

7.17.13

7.17.14

7.17.15

7.17.16

7.17.17

7.17.18

7.17.19

7.17.20

7.17.21

7.17.22

7.17.23

7.17.24

7.17.25

7.17.26

7.17.27

7.17.28

7.17.29

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-56r7-h6mw-rcfv/GHSA-56r7-h6mw-rcfv.json"

org.elasticsearch.plugin:reindex-client

Package

Name: org.elasticsearch.plugin:reindex-client; View open source insights on deps.dev
Purl: pkg:maven/org.elasticsearch.plugin/reindex-client

Affected ranges

Type: ECOSYSTEM
Events: Introduced

8.19.0

Fixed

8.19.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-56r7-h6mw-rcfv/GHSA-56r7-h6mw-rcfv.json"

org.elasticsearch.plugin:reindex-client

Package

Name: org.elasticsearch.plugin:reindex-client; View open source insights on deps.dev
Purl: pkg:maven/org.elasticsearch.plugin/reindex-client

Affected ranges

Type: ECOSYSTEM
Events: Introduced

9.0.0-beta1

Fixed

9.0.8

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-56r7-h6mw-rcfv/GHSA-56r7-h6mw-rcfv.json"

org.elasticsearch.plugin:reindex-client

Package

Name: org.elasticsearch.plugin:reindex-client; View open source insights on deps.dev
Purl: pkg:maven/org.elasticsearch.plugin/reindex-client

Affected ranges

Type: ECOSYSTEM
Events: Introduced

9.1.0

Fixed

9.1.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-56r7-h6mw-rcfv/GHSA-56r7-h6mw-rcfv.json"