Logstash Logs Sensitive Information

MEDIUM 6.5CVE-2016-10362 · GHSA-3gg4-6hqg-2vjx · Published 16/06/2017 · updated 17/06/2026

In short

CVE-2016-10362 is a MEDIUM (CVSS 6.5) vulnerability affecting logstash-core, output plugin (elasticsearch).
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 65.4% of all vulnerabilities.
Fix: update to 5.0.1 or later.

Package	Affected versions	Patched versions
logstash-core RubyGems	`< 5.0.1`	`5.0.1`
output plugin elasticsearch	`≤ 5.0.0`	No fix yet

Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth credentials.

NVD description

Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth credentials.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.