CVE-2026-4819CWE-522CWE-532

Search Guard audit logs can contain under certain conditions user credentials

Medium · published March 31, 2026

CVSS v3.1
4.9
EPSS
0%
Percentile
28.4
In the wild
Unconfirmed
What it is

In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00359 · 28.4th percentile
Weaknesses
CWE-522 · Insufficiently Protected Credentials; CWE-532 · Insertion of Sensitive Information into Log File
Published
2026-03-31T14:57Z
EPSS history
Timeline
  • 31 MAR 14:57Z
    Search Guard audit logs can contain under certain conditions user credentials
    cvelistv5