Read the docs
TI-2019-10085 Aliases CVE-2019-13416GHSA-fgm5-wx7c-v696

Improper authorization in floragunn Search Guard

Priority LOW 31CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-285.

Summary

Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was enabled, authenticated users are always authorized on the local cluster ignoring their roles on the remote cluster(s).

Why it matters now

EPSS 0.00987 62nd percentileScored 2026-11-07
Fix Partial Search Guard (floragunn): 24.3Red Hat: 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
floragunnSearch Guardbefore 24.324.3Patch availableCNA
  • Search Guard Vendorfloragunn Affected before 24.3 Fixed in 24.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:search-guard:search_guard:*:*:*:*:*:*:*:*before 24.3Vulnerablefloragunn
  • cpe:2.3:a:search-guard:search_guard:*:*:*:*:*:*:*:* Versions before 24.3 Vulnerable ·floragunn

Remediation

  • Fix · CNA Search Guard (floragunn) Fixed in 24.3

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 3.10AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 3.11AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 3.9AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-13416
  2. 2026-10-03 Alias added: GHSA-fgm5-wx7c-v696

References

Advisory 2

  • TI-2019-10092 Improper authentication in floragunn Search Guard Kibana Plugin CVSS 3.1HIGH 8.8
  • TI-2019-10088 Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked. CVSS 3.0HIGH 7.5
  • TI-2019-10087 Search Guard versions before 24.0 had an issue that values of string arrays in documents are not properly anonymized. CVSS 3.1HIGH 7.5
  • TI-2019-10084 Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was… CVSS 3.1MEDIUM 6.5
  • TI-2019-10091 Open redirect in floragunn Search Guard Kibana Plugin CVSS 3.0MEDIUM 6.1
  • TI-2019-10089 Search Guard versions before 21.0 had an timing side channel issue when using the internal user database. CVSS 3.1MEDIUM 5.9
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences