Is CVE-2026-4818 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4818 being exploited in the wild.

How severe is CVE-2026-4818?

Medium severity, with a CVSS score of 6.8, published 31 March 2026.

Which products and versions are affected?

Floragunn Search Guard FLX 3.0.0 - 4.0.1.

Is there a fix for CVE-2026-4818?

A patch was published on 2026-03-25: Search Guard FLX 4.1.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-4818 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-4818?

Check whether you run Floragunn Search Guard FLX or Search-Guard Flx at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4818: floragunn Search Guard FLX improper authorization in data stream management

CVE-2026-4818 · Severity: medium · CVSS 6.8 · Published 2026-03-31

Search Guard FLX, a security plugin for Elasticsearch, contains a vulnerability where users can perform management actions on data streams without having the required permissions. This could allow an unauthorized user to modify or disrupt data management processes, potentially impacting data integrity and operational workflows. Organizations using affected versions should upgrade to version 4.1.0 or apply the recommended configuration mitigation.

Technologies: Floragunn Search Guard FLX, Search-Guard Flx. Vendors: Floragunn, Search-Guard.

Quick answers

Is CVE-2026-4818 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4818 being exploited in the wild.
How severe is CVE-2026-4818?: Medium severity, with a CVSS score of 6.8, published 31 March 2026.
Which products and versions are affected?: Floragunn Search Guard FLX 3.0.0 - 4.0.1.
Is there a fix for CVE-2026-4818?: A patch was published on 2026-03-25: Search Guard FLX 4.1.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4818 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-4818?: Check whether you run Floragunn Search Guard FLX or Search-Guard Flx at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper authorization vulnerability (CWE-285/CWE-862) exists in Search Guard FLX versions 3.0.0 to 4.0.1. The flaw allows authenticated users with low privileges to bypass intended access controls and execute management operations on data streams. Exploitation requires network access to the Elasticsearch cluster and valid (though restricted) credentials. Successful exploitation could allow an attacker to modify data stream configurations or perform administrative tasks they are not authorized for. The issue is resolved in Search Guard FLX 4.1.0. A mitigation is available by adding 'indices:admin/data_stream/modify' to the 'searchguard.admin_only_actions' property in elasticsearch.yml.

Affected products

floragunn Search Guard FLX 3.0.0 - 4.0.1

Timeline

2026-03-25: patched: Search Guard FLX 4.1.0 released
2026-03-31: disclosed: Vulnerability disclosed by vendor
2026-03-31: advisory: NVD entry published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.