Read the docs
TI-2019-10090 Aliases CVE-2019-13421GHSA-qvfv-5h6h-r46w

Insufficiently protected credentials in floragunn Search Guard

Priority LOW 25CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 4 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-522.

Summary

Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal user database.

Why it matters now

EPSS 0.01126 66th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Search Guard (floragunn): 23.1Red Hat: 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
floragunnSearch Guardbefore 23.123.1Patch availableCNA
  • Search Guard Vendorfloragunn Affected before 23.1 Fixed in 23.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:search-guard:search_guard:*:*:*:*:*:*:*:*before 23.1Vulnerablefloragunn
  • cpe:2.3:a:search-guard:search_guard:*:*:*:*:*:*:*:* Versions before 23.1 Vulnerable ·floragunn

Remediation

  • Fix · CNA Search Guard (floragunn) Fixed in 23.1

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 3.10AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 3.11AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 3.9AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-13421
  2. 2026-10-03 Alias added: GHSA-qvfv-5h6h-r46w

References

Exploit 1

Advisory 1

Other 1

  • TI-2019-10092 Improper authentication in floragunn Search Guard Kibana Plugin CVSS 3.1HIGH 8.8
  • TI-2019-10088 Search Guard versions before 23.1 had an issue that for aggregations clear text values of anonymised fields were leaked. CVSS 3.0HIGH 7.5
  • TI-2019-10087 Search Guard versions before 24.0 had an issue that values of string arrays in documents are not properly anonymized. CVSS 3.1HIGH 7.5
  • TI-2019-10085 Improper authorization in floragunn Search Guard CVSS 3.1MEDIUM 6.5
  • TI-2019-10084 Search Guard versions before 24.3 had an issue when Cross Cluster Search (CCS) was… CVSS 3.1MEDIUM 6.5
  • TI-2019-10091 Open redirect in floragunn Search Guard Kibana Plugin CVSS 3.0MEDIUM 6.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences