Search Guard FLX Privilege Escalation Vulnerability in Data Stream Management Operations

A vulnerability exists in Search Guard FLX versions 3.0.0 prior to 4.0.1, allowing users without the necessary privileges to perform certain management operations on data streams. This issue arises from inadequate access controls, which can be exploited to manipulate data stream management functions.

Impact

Exploitation of this vulnerability could lead to unauthorized users performing management operations on data streams, potentially disrupting data flow or causing data integrity issues.

Remediation

Users can upgrade to Search Guard FLX version 4.1.0, where this vulnerability has been fixed. If an immediate upgrade is not possible, the issue can be mitigated by adding 'indices:admin/data_stream/modify' to the 'searchguard.admin_only_indices' property in the 'elasticsearch.yml' configuration file.