CVE-2026-4818: Some management operations on data streams are not properly restricted when user does not have the necessary privileges

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-31 · updated 2026-07-24
Weakness: CWE-285

Description

In Search Guard FLX versions from 3.0.0 up to 4.0.1, there exists an issue which allows users without the necessary privileges to execute some management operations against data streams.

Affected products

floragunn Search Guard FLX: from 3.0.0 before 4.1.0 — fixed in 4.1.0

How to fix

Upgrade to a fixed version: floragunn Search Guard FLX 4.1.0. Check the vendor advisory for mitigations.

References

https://docs.search-guard.com/latest/changelog-searchguard-flx-4_1_0
https://search-guard.com/cve-advisory/

Get alerted when CVE-2026-4818 or the next vulnerability affects your stack