Vulnerabilities

TI-2026-04203 CVE-2026-4819 · GHSA-vx77-83rf-gfvg

Search Guard audit logs can contain under certain conditions user credentials

LOW 28

In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0022 Published 2026-03-31 No fix listed CWE-522

TI-2026-04202 CVE-2026-4818 · GHSA-73g6-24f6-wqv9

Some management operations on data streams are not properly restricted when user does not have the necessary privileges

LOW 37

In Search Guard FLX versions from 3.0.0 up to 4.0.1, there exists an issue which allows users without the necessary privileges to execute some management operations against data streams.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00196 Published 2026-03-31 No fix listed CWE-285

TI-2026-04184 CVE-2026-4799 · GHSA-mq38-9qw3-63h6

Open redirect vulnerability in Search Guard Kibana Plugin via manipulated requests

LOW 19

In Search Guard FLX up to version 4.0.1, it is possible to use specially crafted requests to redirect the user to an untrusted URL.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00179 Published 2026-03-31 No fix listed CWE-601

Vulnerabilities

Filters

Search Guard audit logs can contain under certain conditions user credentials

Some management operations on data streams are not properly restricted when user does not have the necessary privileges

Open redirect vulnerability in Search Guard Kibana Plugin via manipulated requests