In Search Guard FLX versions 1.0.0 through 4.0.1, the audit logging feature may record user credentials when users log into Kibana. This results in sensitive authentication details being written to audit logs, which can be read by anyone with access to those logs. The vulnerability is categorized as a credential exposure (CWE‑522) and a log file disclosure (CWE‑532).

The affected product is Floragunn Search Guard FLX. All editions and deployments of the product released between versions 1.0.0 and 4.0.1 are potentially impacted. No specific operating system or sub‑product is mentioned, so any environment running the affected versions must be considered at risk.

The CVSS score of 4.9 indicates moderate severity, and the EPSS score below 1% suggests a low likelihood of exploitation in the wild. The vulnerability is currently not listed in the CISA KEV catalog, meaning it has not yet been identified as a known exploited vulnerability in the field. An attacker would need to read the audit logs after a user has logged in, which is inferred from the description. The description does not indicate that a remote code execution or privilege escalation vector exists; the primary risk is credential compromise through log analysis.