Threat Advisory

Critical RCE Vulnerability in Elastic Cloud via Jinjava Injection

Threat: Vulnerability
Targeted Region: Global
Targeted Sector: Technology & IT
Criticality: Critical

EXECUTIVE SUMMARY:

Elastic has critical template-injection vulnerability CVE-2025-37729, CVSS 9.1 in Elastic Cloud Enterprise (ECE) where improper sanitization in the Jinjava template engine can allow a maliciously crafted template to be evaluated, enabling data exfiltration and server-side command execution; the flaw affects ECE versions 2.5.0 through 3.8.1 and 4.0.0 through 4.0.1, and while exploitation requires administrative access.

RECOMMENDATION:

  • We strongly recommend you update Elastic Cloud Enterprise (ECE) to version 3.8.2 or 4.0.2.

REFERENCES:

The following reports contain further technical details:

crossmenu