GHSA-56r7-h6mw-rcfv: elasticsearch fixed in 9.1.5, 9.0.8, 8.19.5 and 1 more

GHSA-56r7-h6mw-rcfv PUBLISHED CVSS 5.699999809265137 MEDIUM

Elasticsearch: Insertion of Sensitive Information into Log File via reindex API

Record from GitHub Advisory Database · Published October 10, 2025

elasticsearch is fixed in 9.1.5, 9.0.8, 8.19.5 and 1 more (Maven Central)

Elasticsearch: Insertion of Sensitive Information into Log File via reindex API

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
org.elasticsearch:elasticsearch	Maven Central	9.1.5, 9.0.8, 8.19.5, 8.18.8
ruby3.2-elasticsearch	Chainguard	9.2.0-r0
commercial-elasticsearch-8.17	Chainguard	8.17.10-r2
conductor-fips	Chainguard	3.31.0-r4
camunda-zeebe-8.7	Chainguard	8.7.42-r1
ruby3.3-elasticsearch	Chainguard	9.2.0-r0
elasticsearch-fips-8.18	Chainguard	8.18.8-r5
ruby3.4-elasticsearch	Chainguard	9.2.0-r0
elasticsearch-fips-8.17	Chainguard	8.17.10-r14
ruby3.4-elasticsearch	Wolfi	9.2.0-r0
ruby3.3-elasticsearch	Wolfi	9.2.0-r0
camunda-8.8	Chainguard	8.8.40-r0

5 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1

5.699999809265137

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

Vendor	Product	Versions
chainguard	ruby3.2-elasticsearch	0
Maven	org.elasticsearch:elasticsearch	9.0.0-beta1, 7.0.0, 9.1.0
chainguard	commercial-elasticsearch-8.17	0
chainguard	conductor-fips	0
chainguard	camunda-zeebe-8.7	0
chainguard	ruby3.3-elasticsearch	0
chainguard	elasticsearch-fips-8.18	0
chainguard	ruby3.4-elasticsearch	0
chainguard	elasticsearch-fips-8.17	0
wolfi	ruby3.4-elasticsearch	0
wolfi	ruby3.3-elasticsearch	0
chainguard	camunda-8.8	0
chainguard	conductor	0
chainguard	camunda-zeebe-8.6	0
wolfi	ruby3.2-elasticsearch	0
chainguard	camunda-zeebe-8.8	0
chainguard	ranger	0

Timeline

Oct 10, 2025 CVE Published
Apr 29, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-56r7-h6mw-rcfv
vulnetix vdb fixes GHSA-56r7-h6mw-rcfv

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-56r7-h6mw-rcfv/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →