CVE-2026-4819

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4819", "assignerOrgId": "9f311a02-c44f-4938-8530-9219246b8255", "state": "PUBLISHED", "assignerShortName": "floragunn", "dateReserved": "2026-03-25T13:44:37.576Z", "datePublished": "2026-03-31T14:57:56.792Z", "dateUpdated": "2026-03-31T17:23:46.025Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9f311a02-c44f-4938-8530-9219246b8255", "shortName": "floragunn", "dateUpdated": "2026-03-31T14:57:56.792Z"}, "title": "Search Guard audit logs can contain under certain conditions user credentials", "datePublic": "2026-03-31T10:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-532", "description": "CWE-532", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-522", "description": "CWE-522", "type": "CWE"}]}], "affected": [{"vendor": "floragunn", "product": "Search Guard FLX", "versions": [{"status": "affected", "version": "1.0.0", "lessThanOrEqual": "4.0.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana."}]}], "references": [{"url": "https://search-guard.com/cve-advisory/"}, {"url": "https://docs.search-guard.com/latest/changelog-searchguard-flx-4_1_0"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 4.9, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-31T17:23:37.990130Z", "id": "CVE-2026-4819", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-31T17:23:46.025Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4819", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-31T17:23:37.990130Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-31T17:23:42.774Z"}}], "cna": {"title": "Search Guard audit logs can contain under certain conditions user credentials", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "floragunn", "product": "Search Guard FLX", "versions": [{"status": "affected", "version": "1.0.0", "versionType": "semver", "lessThanOrEqual": "4.0.1"}], "defaultStatus": "unaffected"}], "datePublic": "2026-03-31T10:00:00.000Z", "references": [{"url": "https://search-guard.com/cve-advisory/"}, {"url": "https://docs.search-guard.com/latest/changelog-searchguard-flx-4_1_0"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana.", "supportingMedia": [{"type": "text/html", "value": "In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-532", "description": "CWE-532"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-522", "description": "CWE-522"}]}], "providerMetadata": {"orgId": "9f311a02-c44f-4938-8530-9219246b8255", "shortName": "floragunn", "dateUpdated": "2026-03-31T14:57:56.792Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4819", "state": "PUBLISHED", "dateUpdated": "2026-03-31T17:23:46.025Z", "dateReserved": "2026-03-25T13:44:37.576Z", "assignerOrgId": "9f311a02-c44f-4938-8530-9219246b8255", "datePublished": "2026-03-31T14:57:56.792Z", "assignerShortName": "floragunn"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Search Guard FLX", "vendor": "floragunn", "versions": [{"lessThanOrEqual": "4.0.1", "status": "affected", "version": "1.0.0", "versionType": "semver"}]}], "source": "security@search-guard.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:search-guard:flx:*:*:*:*:*:*:*:*", "matchCriteriaId": "625754E5-C0D5-4F0A-8788-B31527465BC1", "versionEndExcluding": "4.1.0", "versionStartIncluding": "1.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana."}, {"lang": "es", "value": "En las versiones de Search Guard FLX desde 1.0.0 hasta 4.0.1, la funci\u00f3n de registro de auditor\u00eda podr\u00eda registrar credenciales de usuario de los usuarios que inician sesi\u00f3n en Kibana."}], "id": "CVE-2026-4819", "lastModified": "2026-07-24T20:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "security@search-guard.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4819", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-31T17:23:37.990130Z", "version": "2.0.3"}}]}, "published": "2026-03-31T16:16:34.730", "references": [{"source": "security@search-guard.com", "tags": ["Release Notes"], "url": "https://docs.search-guard.com/latest/changelog-searchguard-flx-4_1_0"}, {"source": "security@search-guard.com", "tags": ["Vendor Advisory"], "url": "https://search-guard.com/cve-advisory/"}], "sourceIdentifier": "security@search-guard.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}, {"lang": "en", "value": "CWE-532"}], "source": "security@search-guard.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.0,4.0.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Search Guard FLX", "source": "cna", "vendor": "floragunn"}, "product": "search_guard_flx", "vendor": "floragunn"}], "analysis": {"en": {"generated_at": "2026-04-03T17:07:19.595540+00:00", "value": {"mitigation_remediation": ["Upgrade Search Guard FLX to version 4.1.0 or later, as documented in the changelog and CVE advisory.", "If an upgrade cannot be performed immediately, restrict audit log read permissions to only privileged administrators and disable any public or unauthenticated access to the log files.", "Review existing audit logs for exposed credentials and, if found, delete or redact the sensitive entries to prevent credential theft."], "summary": {"action": "Patch", "impact": "Credential Exposure"}, "threat_synthesis": {"affected_systems": "The affected product is Floragunn Search Guard FLX. All editions and deployments of the product released between versions 1.0.0 and 4.0.1 are potentially impacted. No specific operating system or sub\u2011product is mentioned, so any environment running the affected versions must be considered at risk.", "description_and_impact": "In Search Guard FLX versions 1.0.0 through 4.0.1, the audit logging feature may record user credentials when users log into Kibana. This results in sensitive authentication details being written to audit logs, which can be read by anyone with access to those logs. The vulnerability is categorized as a credential exposure (CWE\u2011522) and a log file disclosure (CWE\u2011532).", "risk_and_exploitability": "The CVSS score of 4.9 indicates moderate severity, and the EPSS score below 1% suggests a low likelihood of exploitation in the wild. The vulnerability is currently not listed in the CISA KEV catalog, meaning it has not yet been identified as a known exploited vulnerability in the field. An attacker would need to read the audit logs after a user has logged in, which is inferred from the description. The description does not indicate that a remote code execution or privilege escalation vector exists; the primary risk is credential compromise through log analysis."}}}}, "created": "2026-03-31T19:54:16.466106+00:00", "updated": "2026-04-03T21:17:40.100663+00:00", "vendors": ["floragunn", "floragunn$PRODUCT$search_guard_flx"]}