Search Guard FLX’s audit logging feature may record user credentials when users authenticate to Kibana in versions 1.0.0 through 4.0.1. This flaw results in accidental exposure of usernames and passwords in log files, mapping to CWE-522 and CWE-532, and represents an inappropriate storage and excessive logging of sensitive data. An attacker who can read these logs could obtain login credentials and use them to further compromise the system.

The vulnerability affects all installations of Search Guard FLX from version 1.0.0 up to and including 4.0.1, regardless of operating system. Environments that deploy Kibana with Search Guard FLX are at risk until the software is upgraded to a version released after 4.0.1.

The CVSS base score of 4.9 indicates a moderate severity. The likely attack vector is local or remote read access to the audit log files, which can be achieved by a user with sufficient file‑system permissions or by an attacker who has compromised the host. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploitation has not been widely observed. Nevertheless, because compromised credentials can lead to broader system compromise, administrators should treat this as a priority risk.