Insecure Exposure of Sensitive Information in Elastic Defend by Elastic

CVE-2025-25013

Summary

The vulnerability in Elastic Defend arises from an improper restriction of environment variables, which can inadvertently allow sensitive information such as API keys and tokens to be exposed. This occurs through the automatic transmission of unfiltered environment variables to the stack. As a result, attackers may gain access to critical data that was not intended for public exposure. Organizations using Elastic Defend need to address this vulnerability promptly to safeguard their sensitive information.

References