Is CVE-2026-4799 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4799 being exploited in the wild.

How severe is CVE-2026-4799?

Medium severity, with a CVSS score of 4.3, published 31 March 2026.

Which products and versions are affected?

Floragunn Search Guard FLX 1.0.0 - 4.0.1.

Is there a fix for CVE-2026-4799?

A patch was published on 2026-03-25: Version 4.1.0 released fixing the issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-4799 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-4799?

Check whether you run Floragunn Search Guard FLX or Search-Guard Flx at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4799: floragunn Search Guard FLX open redirect in Kibana Plugin

CVE-2026-4799 · Severity: medium · CVSS 4.3 · Published 2026-03-31

Search Guard FLX, a security plugin for Elasticsearch and Kibana, is vulnerable to an open redirect flaw. An attacker can send a specially crafted link to a user that, when clicked, redirects them from a trusted corporate domain to a malicious website. This technique is commonly used in phishing campaigns to steal user credentials or deliver malware by exploiting the user's trust in the original site.

Technologies: Floragunn Search Guard FLX, Search-Guard Flx. Vendors: Floragunn, Search-Guard.

Quick answers

Is CVE-2026-4799 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4799 being exploited in the wild.
How severe is CVE-2026-4799?: Medium severity, with a CVSS score of 4.3, published 31 March 2026.
Which products and versions are affected?: Floragunn Search Guard FLX 1.0.0 - 4.0.1.
Is there a fix for CVE-2026-4799?: A patch was published on 2026-03-25: Version 4.1.0 released fixing the issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4799 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-4799?: Check whether you run Floragunn Search Guard FLX or Search-Guard Flx at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An open redirect vulnerability (CWE-601) exists in the Search Guard Kibana Plugin component of Search Guard FLX. The flaw is rooted in insufficient validation of user-supplied input used in redirection parameters. A remote, unauthenticated attacker can exploit this by tricking a victim into clicking a specially crafted URL. Successful exploitation allows the attacker to redirect the victim to an arbitrary external domain, facilitating phishing or social engineering attacks. The vulnerability is addressed in Search Guard FLX version 4.1.0.

Affected products

floragunn Search Guard FLX 1.0.0 - 4.0.1

Timeline

2026-03-25: patched: Version 4.1.0 released fixing the issue.
2026-03-31: disclosed: Initial advisory publication.
2026-03-31: advisory: NVD entry published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.