CVE-2025-37727: Elasticsearch: Insertion of Sensitive Information into Log File via reindex API

The vulnerability, CVE-2025-37727, is a case of sensitive information being inserted into log files. This occurs when Elasticsearch's audit logging feature is enabled and a _reindex API call with a remote source is made. The root cause of the vulnerability lies in the incomplete filtering of the request body before it is logged.

The investigation of the patch e982eef416a5e1c2a4e94236d7d3b33b5c8d07db reveals that the RestReindexAction class, which handles the _reindex REST endpoint, had an inadequate filtering mechanism.

Previously, the class implemented the getFilteredFields method, which returned a hardcoded set of fields to be removed from the request before logging. The evidence shows that this set only contained "source.remote.host.password". It failed to include the headers field within the remote object, which could contain sensitive credentials like API keys or authentication tokens.

When a _reindex request was processed for auditing, the default implementation of RestRequestFilter.getFilteredRequest would be used, which in turn called RestReindexAction.getFilteredFields. Due to the incomplete set of filtered fields, any sensitive data in the headers would bypass this filtering and end up in the audit logs.

The patch addresses this by overriding the getFilteredRequest method directly within RestReindexAction. The new implementation inspects the request body and explicitly redacts the values of both the password and headers fields, replacing them with "::es-redacted::". This ensures that even if these fields are present, their sensitive values are not exposed in the logs.

Therefore, the vulnerable function is org.elasticsearch.reindex.RestReindexAction.getFilteredFields because its insufficient implementation was the direct cause of the information leak. Any security engineer with this CVE in their environment should be aware that their audit logs may contain sensitive credentials if they have used the remote reindex feature with authentication headers.