anonhaven
Ad

CVE-2026-4819

MEDIUM CVSS 3.1: 6.5 EPSS 0.04%
Updated Apr 03, 2026
Search-Guard
Parameter Value
CVSS 6.5 (MEDIUM)
Affected Versions 1.0.0 — 4.1.0
Fixed In 4.1.0
Type CWE-522 (Insufficiently Protected Credentials), CWE-532
Vendor Search-Guard
Public PoC No

In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana.

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed

Impact Assessment

Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption

CVSS Vector v3.1

Weakness Type (CWE)

CWE-522 Insufficiently Protected Credentials
CWE-532

Vulnerable Products 1

Configuration From (including) Up to (excluding)
Search-Guard Flx
cpe:2.3:a:search-guard:flx:*:*:*:*:*:*:*:*
 1.0.0 4.1.0

References 2

https://docs.search-guard.com/latest/changelog-searchguard-flx-4_1_0
security@search-guard.com
https://search-guard.com/cve-advisory/
security@search-guard.com
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-4818

Search-Guard

8.1

CVE-2026-4799

Search-Guard

4.3