What is the CVSS score of CVE-2026-4819?

CVE-2026-4819 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Search Guard Flx CVE-2026-4819

EUVD-2026-17507 MEDIUM

Insertion of Sensitive Information into Log File (CWE-532)

2026-03-31 floragunn

GHSA-vx77-83rf-gfvg

Information Disclosure Elastic Search Guard Flx Floragunn

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Jul 24, 2026 - 20:22 NVD

4.9 (MEDIUM) 6.5 (MEDIUM)

EUVD ID Assigned

Mar 31, 2026 - 15:31 euvd

EUVD-2026-17507

Analysis Generated

Mar 31, 2026 - 15:31 vuln.today

CVE Published

Mar 31, 2026 - 14:57 nvd

MEDIUM 4.9

DescriptionNVD

In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana.

AnalysisAI

Search Guard FLX versions 1.0.0 through 4.0.1 leak user credentials into audit logs when users authenticate through Kibana, exposing plaintext authentication material to any system administrator or user with log access. The vulnerability requires high-privilege access to exploit and affects only confidentiality, but the presence of credentials in audit logs creates a persistent information disclosure risk that persists across backup and archival systems.

Technical ContextAI

Search Guard FLX is an authentication and authorization plugin for Elasticsearch and Kibana developed by floragunn. The audit logging feature (CWE-532: Insertion of Sensitive Information into Log File) fails to sanitize or filter user credentials during the authentication flow when users log into Kibana. The affected versions span from the initial 1.0.0 release through 4.0.1, covering a broad range of Elasticsearch/Kibana deployments using Search Guard for access control. The root cause is inadequate log scrubbing at the audit layer, where credential material from login requests is recorded verbatim rather than masked, hashed, or omitted.

RemediationAI

Upgrade Search Guard FLX to version 4.1.0 or later, which remediates the credential logging issue. See the changelog at https://docs.search-guard.com/latest/changelog-searchguard-flx-4_1_0 for release details. In parallel, review and rotate any credentials that may have been logged in Elasticsearch audit logs from affected versions, particularly those visible in Kibana login events during the window of vulnerability exposure. If immediate upgrade is not feasible, implement access controls on audit logs to restrict viewing permissions to systems and personnel with legitimate operational need, and consider log retention minimization to reduce the persistence window of exposed credentials.