# Elasticsearch 8.18.8, 8.19.5, 9.0.8, 9.1.5 Security Update (ESA-2025-18)

**URL:** https://discuss.elastic.co/t/elasticsearch-8-18-8-8-19-5-9-0-8-9-1-5-security-update-esa-2025-18/382453
**Category:** Security Announcements
**Created:** [October 6, 2025, 4:40pm UTC](https://discuss.elastic.co/t/elasticsearch-8-18-8-8-19-5-9-0-8-9-1-5-security-update-esa-2025-18/382453 "2025-10-06T16:40:57Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![ismisepaul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ismisepaul/32/102235_2.png) [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)
#### Post date: [October 6, 2025, 4:40pm UTC](https://discuss.elastic.co/t/elasticsearch-8-18-8-8-19-5-9-0-8-9-1-5-security-update-esa-2025-18/382453/1 "2025-10-06T16:40:57Z")

</div>

**Elasticsearch Insertion of sensitive information in log file (ESA-2025-18)**

Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the [reindex API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex)

**Affected Versions:**

- **7.x:** All versions from 7.0.0 and up to and including 7.17.29
- **8.x:** All versions from 8.0.0 and up to and including 8.18.7
- **8.19.x:** All versions from 8.19.0 and up to and including 8.19.4
- **9.0.x:** All versions from 9.0.0 and up to and including 9.0.7
- **9.1.x:** All versions from 9.1.0 and up to and including 9.1.4

**Affected Configurations:**

This affects deployments where all the below are true:

- Audit logging is enabled ( `xpack.security.audit.enabled: true` )

- Audit logging is configured to contain authentication\_success events ( `xpack.security.audit.logfile.events.include includes authentication_success` )

- Audit logging is explicitly configured to capture request bodies ( `xpack.security.audit.logfile.events.emit_request_body: true` ). The default value is `false`.

**Solutions and Mitigations:**

The issue is resolved in version 8.18.8, 8.19.5, 9.0.8, 9.1.5.

**For Users that Cannot Upgrade:**

If the affected configuration is in use:

**Self-hosted**

Users can set `xpack.security.audit.logfile.events.emit_request_body` to `false`

**Cloud**

Users can set `xpack.security.audit.logfile.events.emit_request_body` to `false`

**Severity:** CVSSv3.1: Medium(5.3) CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

**CVE ID** : CVE-2025-37727