Executive brief
Search Guard FLX, a security plugin for Elasticsearch, contains a vulnerability where users can perform management actions on data streams without having the required permissions. This could allow an unauthorized user to modify or disrupt data management processes, potentially impacting data integrity and operational workflows. Organizations using affected versions should upgrade to version 4.1.0 or apply the recommended configuration mitigation.
Technical details
An improper authorization vulnerability (CWE-285/CWE-862) exists in Search Guard FLX versions 3.0.0 to 4.0.1. The flaw allows authenticated users with low privileges to bypass intended access controls and execute management operations on data streams. Exploitation requires network access to the Elasticsearch cluster and valid (though restricted) credentials. Successful exploitation could allow an attacker to modify data stream configurations or perform administrative tasks they are not authorized for. The issue is resolved in Search Guard FLX 4.1.0. A mitigation is available by adding 'indices:admin/data_stream/modify' to the 'searchguard.admin_only_actions' property in elasticsearch.yml.
Affected products
- floragunn Search Guard FLX 3.0.0 - 4.0.1
Timeline
- 2026-03-25: patched: Search Guard FLX 4.1.0 released
- 2026-03-31: disclosed: Vulnerability disclosed by vendor
- 2026-03-31: advisory: NVD entry published