CVE-2025-12147
MediumCVSS 6.0Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
In Search Guard FLX versions 3.1.1 and earlier, Field-Level Security (FLS) rules are improperly enforced on object-valued fields. When an FLS exclusion rule (e.g., ~field) is applied to a field which contains an object as its value, the object is correctly removed from the _source returned by search operations. However, the object members (i.e., child attributes) remain accessible to search queries. This exposure allows adversaries to infer or reconstruct the original contents of the excluded object.
Risk Assessment
An attacker could infer or reconstruct the contents of an excluded object, leading to disclosure of sensitive data. This could violate security and privacy policies.
Recommendation
Update Search Guard FLX to a version later than 3.1.1. If immediate upgrade is not possible, add an additional exclusion rule for the members of the object (e.g., ~object.*).
Other vulnerabilities in Search Guard FLX
See all- CVE-2026-4819Medium
In Search Guard FLX from version 1.0.0 up to 4.0.1, a vulnerability was found where the audit logging feature might log user credentials from users logging into Kibana.
- CVE-2026-4818Medium
Search Guard FLX versions 3.0.0 through 4.0.1 allow users without the necessary privileges to execute management operations on data streams.
- CVE-2026-4799Medium
Search Guard FLX up to version 4.0.1 allows redirecting users to an untrusted URL via specially crafted requests.
- CVE-2025-12149Medium
In Search Guard FLX versions 3.1.2 and earlier, when a search is triggered from a Signals watch, the Document-Level Security (DLS) rule is not enforced, allowing access to all documents in the queried indices, despite DLS being correctly enforced elsewhere.
Original NVD description (English source)
In Search Guard FLX versions 3.1.1 and earlier, Field-Level Security (FLS) rules are improperly enforced on object-valued fields. When an FLS exclusion rule (e.g., ~field) is applied to a field which contains an object as its value, the object is correctly removed from the _source returned by search operations. However, the object members (i.e., child attributes) remain accessible to search queries. This exposure allows adversaries to infer or reconstruct the original contents of the excluded object. Workaround - If you cannot upgrade immediately and FLS exclusion rules are used for object valued attributes (like ~object), add an additional exclusion rule for the members of the object (like ~object.*).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS