CVE-2026-4819

MediumCVSS 4.9

Published: 31/03/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

12th percentile - higher than 12% of all known CVEs

Summary

In Search Guard FLX from version 1.0.0 up to 4.0.1, a vulnerability was found where the audit logging feature might log user credentials from users logging into Kibana.

Risk Assessment

The risk involves potential leakage of passwords or authentication tokens to log files, which could lead to unauthorized access.

Recommendation

It is recommended to upgrade to a version above 4.0.1 and review audit configuration to avoid logging sensitive data.

Other vulnerabilities in Search Guard FLX

See all

CVE-2026-4818Medium
Search Guard FLX versions 3.0.0 through 4.0.1 allow users without the necessary privileges to execute management operations on data streams.
CVE-2026-4799Medium
Search Guard FLX up to version 4.0.1 allows redirecting users to an untrusted URL via specially crafted requests.

Original NVD description (English source)

In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS