Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
Elasticsearch may expose log data to attackers
published 5 days ago
Summary
The Elasticsearch package includes a logging component that can write logs in XML format. An error in this component could allow a remote user to view or manipulate the log contents, potentially revealing sensitive information. Update Elasticsearch to the latest version or apply the vendor’s recommended patch to stop the issue.
What to do
- Update cleanstart elasticsearch to version 9.2.7-r1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | elasticsearch |
< 9.2.7-r1 Fix: upgrade to 9.2.7-r1
|
Original advisory text
Apache Log4j Core's XmlLayout https://logging
Security vulnerability affects the elasticsearch package. Apache Log4j Core's XmlLayout https://logging.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-AT50315 · OSV
Track software like this
Free during beta