Search Guard FLX 4.2.0
Release Date: 2026-09-18
Upgrade Notice
When you are upgrading from 9.4.x to 9.5.x, the suggest feature is insecure to use during the upgrade process in a mixed cluster when the cluster setting search.batched_query_phase is set to true.
In this case, set search.batched_query_phase to false before you start the upgrade and re-enable it after all nodes have been upgraded.
Security Fixes
Transforms can leak data under some circumstances
In Search Guard FLX versions before 4.2.0, the transform API can leak data under some circumstances.
Search Guard FLX 4.2.0 ensures proper transform action authorization and adds some further safeguards to prevent data leakage.
If you can’t upgrade yet, we recommend removing the transform cluster privileges from all users.
Details will be made available on the CVE Advisory Page.
New features
New oidc_userinfo backend for JWT authentication domains
If the JWT does not contain all claims required for user mapping, Search Guard can now retrieve additional claims from the OIDC UserInfo endpoint.
The JWT is sent to the endpoint as a bearer access token, and the returned claims are available under oidc_user_info.
Support dynamic authentication methods by Kibana host name
If a Kibana instance is available under several host names, you can use enable_by_host to make authentication domains available only on particular hosts.
This can be useful, for example, when a single Kibana instance serves several customers that use different identity providers.
Support for lowercasing JWT claim values
Adds optional lowercase normalization to user mappings configured in sg_authc.yml. The conversion settings are parsed within the corresponding mapping specifications and applied before the final user object is created.
Signals: Add support for tenant-scoped accounts
Search Guard FLX 4.2.0 introduces tenant-scoped Signals accounts alongside existing tenant-independent accounts. Tenant accounts are available only to watches in the same tenant, with tenant-independent accounts retained as a fallback.
Improvements
Add desired_balance permissions to SGS_XP_MONITORING
Bug fixes
Restore case-insensitive REST header lookup in user mapping attributes
This fixes a regression introduced in Search Guard FLX 4.1.2: the normalization of REST request headers for user mapping attributes broke proxy authentication in Kibana.
Fixed sgctl hanging when only a single CPU core is assigned to the ES node
Fixes an sgctl deadlock on nodes with a single CPU core.
Fixed FLS nested field behavior
An FLS nested field was not returned when another role had the same nested field in an FLS rule or excluded the parent field.
Signals: Fixed watches not being shown in the operator view in the global tenant
Watches were not loaded in the operator view when multitenancy was enabled and the global tenant was selected.
Signals: Fixed watches created via Kibana not triggering alerts
Watches using the Graph watch type with severity enabled no longer get a default > 1000 threshold condition added on save, which could stop severity alerts from triggering. Re-save affected watches to restore alerting.
Signals: Fixed the email action GUI overriding the configured default sender
An account’s default_from mail address was overwritten by the UI’s default value ‘signals@localhost’. Clearing that default value stored an action with an empty from address instead of falling back to the account default, which caused mail delivery to fail.
Signals: Fixed navigation visibility
Fixed an issue where the Signals navigation entry was displayed even when Signals was not available to the current user.