CVE-2026-4818

In Search Guard FLX from version 1.0.0 up to 4.0.1, a vulnerability was found where the audit logging feature might log user credentials from users logging into Kibana.

Search Guard FLX up to version 4.0.1 allows redirecting users to an untrusted URL via specially crafted requests.

In Search Guard FLX versions from 3.1.0 up to 4.0.0 with enterprise modules disabled, authenticated users can use specially crafted requests to read documents from data streams without having the respective privileges.

In Search Guard FLX versions 3.1.2 and earlier, when a search is triggered from a Signals watch, the Document-Level Security (DLS) rule is not enforced, allowing access to all documents in the queried indices, despite DLS being correctly enforced elsewhere.

In Search Guard FLX versions 3.1.1 and earlier, Field-Level Security (FLS) rules are improperly enforced on object-valued fields. When an FLS exclusion rule (e.g., ~field) is applied to a field which contains an object as its value, the object is correctly removed from the _source returned by search operations. However, the object members (i.e., child attributes) remain accessible to search queries. This exposure allows adversaries to infer or reconstruct the original contents of the excluded object.