CVE-2025-12148 Unauthorized access to fields protected by Field Masking (FM) for fields of type IP
Attackers can reconstruct masked IP addresses in Search Guard by exploiting search result leaks, bypassing field masking protections.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-12148?
CVE-2025-12148 is a medium-severity vulnerability in floragunn Search Guard FLX, published on 29 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In Search Guard versions 3.1.1 and earlier, Field Masking (FM) rules are improperly enforced on fields of type IP (IP Address).
While the content of these fields is properly redacted in the _source document returned by search operations, the results do return documents (hits) when searching based on a specific IP values. This allows to reconstruct the original contents of the field.
Workaround - If you cannot upgrade immediately, you can avoid the problem by using field level security (FLS) protection on fields of the affected types instead of field masking.
Which versions are affected by CVE-2025-12148?
How do I fix CVE-2025-12148?
No fix has been published for CVE-2025-12148 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-12148 being exploited?
There is no known exploitation of CVE-2025-12148 in the wild and no public exploit code.
Sources
Also known as GHSA-p868-4f8c-8pq7.