opensearch-project vulnerabilities

Products

• security 7
• data-prepper 2
• OpenSearch 2
• anomaly-detection 1
• notifications 1
• observability 1
• OpenSearch-Dashboards 1
• opensearch-ruby 1
• reporting 1
• security-dashboards-plugin 1
• sql 1

Latest opensearch-project CVEs

Newest publication first

1. CVE-2026-64686 OpenSearch Dashboards: SSRF in fetchDataSourceMetaData — missing endpoint validation

   Published 2026-11-11

   Medium·CVSS 5.0 EPSS 0.26%

   OpenSearch Dashboards is an open-source data visualization tool designed to work with OpenSearch. From versions 2.14.0 to before 2.19.6, and 3.0.0 to before 3.7.0, a Server-Side Request Forgery (SSRF) vulnerability in OpenSearch Dashboards exists in the fetchDataSourceMetaData ro...

2. CVE-2026-63393 OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution

   Published 2026-10-30

   High·CVSS 8.7 EPSS 0.50%

   OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted cursor parameter to the p...

3. GHSA-27f5-xjrr-q9ff Malware in @opensearch-project/opensearch

   Published 2026-05-19

   Critical·CVSS 9.6

   Overview The OpenSearch Project has sustained a security incident involving an external actor gaining force-push permissions within the project's CI infrastructure to embed malicious packages into four release versions of @opensearch-project/opensearch. Users are instructed to im...

4. CVE-2025-62371 OpenSearch Data Prepper plugins trusts all SSL certificates by default

   Published 2025-10-15

   High·CVSS 7.4 EPSS 0.19%

   OpenSearch Data Prepper as an open source data collector for observability data. In versions prior to 2.12.2, the OpenSearch sink and source plugins in Data Prepper trust all SSL certificates by default when no certificate path is provided. Prior to this fix, the OpenSearch sink...

5. CVE-2024-55886 OpenTelemetry Logs source may lack authentication with some custom plugins

   Published 2024-12-12

   Medium·CVSS 6.9 EPSS 0.33%

   OpenSearch Data Prepper is a component of the OpenSearch project that accepts, filters, transforms, enriches, and routes data at scale. A vulnerability exists in the OpenTelemetry Logs source in Data Prepper starting inversion 2.1.0 and prior to version 2.10.2 where some custom a...

6. CVE-2024-43794 OpenSearch Dashboards Security Plugin improper validation of nextUrl can lead to external redirect

   Published 2024-08-23

   Medium·CVSS 6.1 EPSS 0.26%

   OpenSearch Dashboards Security Plugin adds a configuration management UI for the OpenSearch Security features to OpenSearch Dashboards. Improper validation of the nextUrl parameter can lead to external redirect on login to OpenSearch-Dashboards for specially crafted parameters. A...

7. CVE-2024-39900 OpenSearch Dashboards Reports does not properly restrict access to private tenant resources

   Published 2024-07-09

   Medium·CVSS 5.4 EPSS 0.31%

   OpenSearch Dashboards Reports allows ‘Report Owner’ export and share reports from OpenSearch Dashboards. An issue in the OpenSearch reporting plugin allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource...

8. CVE-2024-39901 OpenSearch Observability does not properly restrict access to private tenant resources

   Published 2024-07-09

   Medium·CVSS 5.4 EPSS 0.29%

   OpenSearch Observability is collection of plugins and applications that visualize data-driven events. An issue in the OpenSearch observability plugins allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resour...

9. CVE-2023-45807 OpenSearch Issue with tenant read-only permissions

   Published 2023-10-16

   Medium·CVSS 5.4 EPSS 0.49%

   OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 2021. There is an issue with the implementation of tenant permissions in OpenSearch Dashboards where authenticated users with read-only access to a tenant can perf...

10. CVE-2023-31141 OpenSearch issue with fine-grained access control during extremely rare race conditions

    Published 2023-05-08

    Medium·CVSS 5.9 EPSS 0.46%

    OpenSearch is open-source software suite for search, analytics, and observability applications. Prior to versions 1.3.10 and 2.7.0, there is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) whe...

11. CVE-2023-25806 Time discrepancy in authentication responses in OpenSearch

    Published 2023-03-02

    Medium·CVSS 5.3 EPSS 0.33%

    OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issue only affects calls...

12. CVE-2023-23933 Issue in Anomaly Detection with document and field level rules in numerical feature aggregations

    Published 2023-02-03

    Medium·CVSS 4.3 EPSS 0.51%

    OpenSearch Anomaly Detection identifies atypical data and receives automatic notifications. There is an issue with the application of document and field level restrictions in the Anomaly Detection plugin, where users with the Anomaly Detector role can read aggregated numerical da...

13. CVE-2023-23612 Issue with whitespace in JWT roles in OpenSearch

    Published 2023-01-24

    High·CVSS 8.8 EPSS 0.83%

    OpenSearch is an open source distributed and RESTful search engine. OpenSearch uses JWTs to store role claims obtained from the Identity Provider (IdP) when the authentication backend is SAML or OpenID Connect. There is an issue in how those claims are processed from the JWTs whe...

14. CVE-2023-23613 Field-level security issue with .keyword fields in OpenSearch

    Published 2023-01-24

    Medium·CVSS 6.5 EPSS 0.86%

    OpenSearch is an open source distributed and RESTful search engine. In affected versions there is an issue in the implementation of field-level security (FLS) and field masking where rules written to explicitly exclude fields are not correctly applied for certain queries that rel...

15. CVE-2022-41917 Incorrect Error Handling Allowed Partial File Reads Over REST API in OpenSearch

    Published 2022-11-15

    Medium·CVSS 4.3 EPSS 0.75%

    OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. OpenSearch allows users to specify a local file when defining text analyzers to process data for text analysis. An issue in the implementation of this feature allows certain specially crafted queries...

16. CVE-2022-41918 Issue with fine-grained access control of indices backing data streams

    Published 2022-11-15

    Medium·CVSS 6.3 EPSS 0.56%

    OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the indices tha...

17. CVE-2022-41906 OpenSearch Notifications is vulnerable to Server-Side Request Forgery (SSRF)

    Published 2022-11-11

    High·CVSS 8.7 EPSS 0.89%

    OpenSearch Notifications is a notifications plugin for OpenSearch that enables other plugins to send notifications via Email, Slack, Amazon Chime, Custom web-hook etc channels. A potential SSRF issue in OpenSearch Notifications Plugin starting in 2.0.0 and prior to 2.2.1 could al...

18. CVE-2022-35980 OpenSearch vulnerable to Improper Authorization of Index Containing Sensitive Information

    Published 2022-08-12

    High·CVSS 7.5 EPSS 1.2%

    OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. Versions 2.0.0.0 and 2.1.0.0 of the security plugin are affected by an information disclosure vulnerability. Requests to an OpenSearch cluster configured with advanced access...

19. CVE-2022-31115 Unsafe YAML deserialization in opensearch-ruby

    Published 2022-06-30

    High·CVSS 8.8 EPSS 1.6% PoC

    opensearch-ruby is a community-driven, open source fork of elasticsearch-ruby. In versions prior to 2.0.1 the ruby YAML.load function was used instead of YAML.safe_load. As a result opensearch-ruby 2.0.0 and prior can lead to unsafe deserialization using YAML.load if the response...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.