CVE-2019-13421: Search-Guard Search Guard

Medium severity, CVSS 4.9. EPSS: 1.1% chance of exploitation in the next 30 days.

Search Guard versions before 23.1 had an issue that an administrative user is able to retrieve bcrypt password hashes of other users configured in the internal user database.

Affected products

• Search-Guard Search Guard: before 23.1 (fixed in 23.1)

Published 2019-08-23. Last modified 2026-06-17.