Introduction
A critical flaw in the template engine of Elastic Cloud Enterprise lets attackers with admin access exfiltrate sensitive data and execute commands. Organizations that use ECE to manage Elasticsearch clusters must act to prevent privilege abuse and lateral movement within their infrastructure.
Elastic Cloud Enterprise (ECE) is Elastic's orchestration platform for deploying and managing Elasticsearch clusters in private and hybrid environments. Elastic is a leading provider of search and observability products, with customers worldwide and a large presence in enterprise infrastructure.
Technical Information
CVE-2025-37729 is a critical vulnerability in Elastic Cloud Enterprise caused by improper neutralization of special elements in the Jinjava template engine. Jinjava is a Java-based template engine that renders dynamic content with a syntax similar to Jinja2. ECE processes certain configuration fields or templates with Jinjava. If user-controlled input is not properly sanitized, an attacker with admin privileges can inject malicious Jinjava expressions. When the backend evaluates them, the attacker can:
- Exfiltrate sensitive information available to the application context
- Execute arbitrary commands on the underlying system (depending on the template engine's capabilities and context)
The vulnerability is classified under CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine). Exploitation requires authenticated admin access, so an attacker must first obtain or compromise admin credentials. No public code snippets or proof of concept are available at this time.
Affected Systems and Versions
- Elastic Cloud Enterprise versions prior to 3.8.2 and 4.0.2 are affected
- Every ECE deployment running an earlier version is vulnerable if an attacker can obtain admin access
- The vulnerability is present in configurations where Jinjava templates process user input
Vendor Security History
Elastic has a history of fixing vulnerabilities in its products, including earlier template injection and privilege escalation issues. The company runs a mature security program, publishes regular security advisories, and coordinates patch releases. It generally responds promptly, communicates clearly, and has patches available at disclosure.
