CVE-2026-4819: fallo de gravedad media en floragunn Search Guard FLX
Search Guard audit logs can contain under certain conditions user credentials
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.9epss 0.2%
In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Productos afectados
floragunn · Search Guard FLXCVEs relacionadas — floragunn Search Guard FLX
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-12149MEDIUMUnauthorized access to documents protected by Document-Level Security (DLS), when Signals watches include a search query involving protected documentsEPSS 0.3%CVE-2025-12148MEDIUMUnauthorized access to fields protected by Field Masking (FM) for fields of type IPEPSS 0.3%CVE-2025-12147MEDIUMUnauthorized access to fields protected by Field-Level Security (FLS) when those fields are members of an objectEPSS 0.3%CVE-2025-13653MEDIUMUnauthorized access to documents in data streams with specially crafted requestsEPSS 0.2%CVE-2026-4818MEDIUMSome management operations on data streams are not properly restricted when user does not have the necessary privilegesEPSS 0.2%CVE-2026-4799MEDIUMOpen redirect vulnerability in Search Guard Kibana Plugin via manipulated requestsEPSS 0.2%