CVE-2025-37727

What it actually does

Insertion of sensitive information into log files occurs when auditing is enabled for reindex API requests in Elasticsearch, exposing confidential data under specific preconditions.

Why it matters to the business

Organizations running affected Docker packages on SUSE systems face potential leakage of sensitive operational data through logs, increasing risk of unauthorized access to internal information; the issue has been public for over a year with stable low exploit likelihood.

How an attack unfolds

An attacker with access to Elasticsearch audit logs can obtain sensitive details if reindex API requests are audited, as the requests may include confidential parameters that get recorded in logs without proper redaction.

How to fix it

Upgrade affected Docker packages to the listed fixed versions: docker packages to 27.5.1_ce-150000.218.1 and docker-stable packages to 24.0.9_ce-150000.1.15.1 on all listed SUSE distributions.

How to confirm the fix worked

Verify package versions match the fixed releases above, review Elasticsearch audit configuration to ensure reindex requests no longer log sensitive fields, and inspect sample log outputs for absence of confidential data.

Typical attack path

1. Identify Elasticsearch instances with auditing enabled for the reindex API
2. Trigger or observe reindex operations that include sensitive request data
3. Access the resulting log files to extract exposed confidential information

How to detect it

Examine Elasticsearch audit logs for reindex API entries containing unredacted sensitive parameters; check system logs and Docker container outputs for unexpected data exposure patterns after reindex operations.

What your security team should do

• Apply the specified Docker package upgrades immediately across all SUSE environments
• Review and restrict auditing configurations for the reindex API to minimize logging of sensitive fields
• Monitor log access controls and rotate any potentially exposed credentials or tokens