CVE-2025-37729
CriticalCVSS 9.1Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
Improper neutralization of special elements in the template engine of Elastic Cloud Enterprise (ECE) allows an admin-level actor to exfiltrate sensitive information and issue commands via a specially crafted string where Jinjava variables are evaluated.
Risk Assessment
This vulnerability enables a privileged administrator to bypass controls and perform unauthorized operations, potentially leading to data leakage and integrity compromise. The risk is high in environments where administrative access is broadly granted.
Recommendation
Upgrade Elastic Cloud Enterprise to the vendor-patched version. Also restrict the number of admin accounts and audit templates using Jinjava.
Other vulnerabilities in Elastic Cloud Enterprise
See all- CVE-2026-115713High
Improper Link Resolution Before File Access (CWE-59) in Elastic Cloud Enterprise (ECE) allows a symlink attack (CAPEC-132). This can lead to unauthorized read and write access to data of other deployments on the same host.
- CVE-2026-115712Medium
Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) allows an authenticated user with read-only access to change an installation-wide account setting that only platform administrators should be permitted to change.
- CVE-2026-115711Medium
Insertion of Sensitive Information into an Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to credential disclosure. ECE stores runtime information about platform service containers in a location readable by lower-privileged components, and this data includes secrets from container configuration, including role tokens.
- CVE-2026-115709High
Improper Link Resolution Before File Access (CWE-59) in Elastic Cloud Enterprise (ECE) allows a symlink attack (CAPEC-132). This can lead to unauthorized disclosure and loss of data belonging to other deployments on the same host.
- CVE-2026-115708High
Improper Link Resolution Before File Access (CWE-59) in Elastic Cloud Enterprise (ECE) allows a symlink attack (CAPEC-132). This can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host.
- CVE-2026-115707Medium
Insertion of Sensitive Information into an Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation. After the ECE certificate rotation procedure runs, retained data contains platform credentials and certificate authority private keys readable by lower-privileged components.
- CVE-2026-115706Medium
Authorization Bypass Through a User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation. An attacker who controls any host in an ECE installation can obtain credentials reserved for other platform roles.
- CVE-2025-37736High
Improper Authorization in Elastic Cloud Enterprise can lead to Privilege Escalation where the built-in readonly user can call APIs that should not be allowed. The affected APIs include operations on service accounts, users, and API keys.
Original NVD description (English source)
Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variables are evaluated.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS