GHSA-22vx-2x23-98w6
OpenSearch vulnerable to improper authorization for Rollover Requests
Description
A flaw was identified in the OpenSearch Security plugin's handling of index rollover requests. When a rollover request included an explicit target index name, the security plugin did not properly evaluate access control permissions against the target index. This could allow a user with rollover permissions on a source index to create a new index with a name they are not authorized to use.
Impact
A user with indices:admin/rollover permission on a source index pattern could roll over to a target index name outside their authorized index patterns. This is limited to index creation via the rollover API and requires the user to already have rollover privileges on the source index.
Patches
This issue is fixed in OpenSearch 2.19.4 and 3.2.0
Workarounds
Grant the indices:admin/rollover permission only to fully trusted users.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
What each source reports
GitHub Advisories Score used
OpenSearch vulnerable to improper authorization for Rollover Requests
Description
A flaw was identified in the OpenSearch Security plugin's handling of index rollover requests. When a rollover request included an explicit target index name, the security plugin did not properly evaluate access control permissions against the target index. This could allow a user with rollover permissions on a source index to create a new index with a name they are not authorized to use.
Impact
A user with indices:admin/rollover permission on a source index pattern could roll over to a target index name outside their authorized index patterns. This is limited to index creation via the rollover API and requires the user to already have rollover privileges on the source index.
Patches
This issue is fixed in OpenSearch 2.19.4 and 3.2.0
Workarounds
Grant the indices:admin/rollover permission only to fully trusted users.
- Record
GHSA-22vx-2x23-98w6- CVSS 3.1
- 2.2 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSV
OpenSearch vulnerable to improper authorization for Rollover Requests
Description
A flaw was identified in the OpenSearch Security plugin's handling of index rollover requests. When a rollover request included an explicit target index name, the security plugin did not properly evaluate access control permissions against the target index. This could allow a user with rollover permissions on a source index to create a new index with a name they are not authorized to use.
Impact
A user with indices:admin/rollover permission on a source index pattern could roll over to a target index name outside their authorized index patterns. This is limited to index creation via the rollover API and requires the user to already have rollover privileges on the source index.
Patches
This issue is fixed in OpenSearch 2.19.4 and 3.2.0
Workarounds
Grant the indices:admin/rollover permission only to fully trusted users.
- Record
GHSA-22vx-2x23-98w6- CVSS 3.1
- 2.2 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.opensearch.plugin:opensearch-securityMaven | 1.0.0 to 2.19.3 | 2.19.4.0 |
org.opensearch.plugin:opensearch-securityMaven | 3.0.0 to 3.1.0 | 3.2.0.0 |
org.opensearch.plugin:opensearch-securityMaven | 1.0.0 up to 2.19.4.0, plus listed versions 2.1.0.02.10.0.02.11.0.02.11.1.02.12.0.0 Show 21 moreShow less2.13.0.02.14.0.02.15.0.02.16.0.02.17.0.02.17.1.02.18.0.02.19.0.02.19.1.02.19.2.02.19.3.02.2.0.02.2.1.02.3.0.02.4.0.02.4.1.02.5.0.02.6.0.02.7.0.02.8.0.02.9.0.0 | 2.19.4.0 |
org.opensearch.plugin:opensearch-securityMaven | 3.0.0 up to 3.2.0.0, plus listed versions 3.0.0.03.1.0.0 | 3.2.0.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-22vx-2x23-98w6 is a low vulnerability (CVSS 2.2) in org.opensearch.plugin:opensearch-security, published May 7, 2026. No source lists public exploit code. Fixed in org.opensearch.plugin:opensearch-security 2.19.4.0.