{"id":"GHSA-x5hg-x4gv-j98m","aliases":[],"status":"published","title":"OpenSearch has ineffective TLS certificate hostname verification","description":"### Description\n\nA regression was introduced in OpenSearch 2.18.0 that caused the `plugins.security.ssl.transport.enforce_hostname_verification` setting to be ineffective. When this setting was enabled, OpenSearch did not verify that the hostname in a connecting node's TLS certificate matched the hostname of the connection. This could allow a node with a valid certificate (signed by the cluster's trusted CA) but an incorrect hostname SAN to join the cluster.\n\n### Impact\n\nClusters running affected versions with hostname verification enabled did not receive the expected protection from this setting. A node presenting a certificate signed by the cluster's trusted CA could join the cluster regardless of whether its hostname SAN matched. This regression does not affect certificate validation itself — only the additional hostname verification check.\n\n### Patches\n\nThis issue is fixed in OpenSearch 2.19.4 and 3.3.0.\n\n### Workarounds\n\nUse more restrictive values for `plugins.security.nodes_dn` to limit which certificates are accepted for node-to-node communication.","severity":{"version":"3.1","score":2.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2026-05-07T00:09:18Z","modified":"2026-05-07T00:21:11Z","fixes":[{"ecosystem":"Maven","package":"org.opensearch.plugin:opensearch-security","fixed_in":["2.19.4.0","3.3.0.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.opensearch.plugin:opensearch-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.0"},{"fixed":"2.19.4.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.opensearch.plugin:opensearch-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.3.0.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.opensearch.plugin:opensearch-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.0"},{"fixed":"2.19.4.0"}]}],"versions":["2.18.0.0","2.19.0.0","2.19.1.0","2.19.2.0","2.19.3.0"]},{"source":"osv","ecosystem":"Maven","package":"org.opensearch.plugin:opensearch-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.3.0.0"}]}],"versions":["3.0.0.0","3.1.0.0","3.2.0.0"]}],"references":[{"url":"https://github.com/opensearch-project/security/security/advisories/GHSA-x5hg-x4gv-j98m","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x5hg-x4gv-j98m"},{"url":"https://github.com/opensearch-project/security","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-x5hg-x4gv-j98m","title":"OpenSearch has ineffective TLS certificate hostname verification","description":"### Description\n\nA regression was introduced in OpenSearch 2.18.0 that caused the `plugins.security.ssl.transport.enforce_hostname_verification` setting to be ineffective. When this setting was enabled, OpenSearch did not verify that the hostname in a connecting node's TLS certificate matched the hostname of the connection. This could allow a node with a valid certificate (signed by the cluster's trusted CA) but an incorrect hostname SAN to join the cluster.\n\n### Impact\n\nClusters running affected versions with hostname verification enabled did not receive the expected protection from this setting. A node presenting a certificate signed by the cluster's trusted CA could join the cluster regardless of whether its hostname SAN matched. This regression does not affect certificate validation itself — only the additional hostname verification check.\n\n### Patches\n\nThis issue is fixed in OpenSearch 2.19.4 and 3.3.0.\n\n### Workarounds\n\nUse more restrictive values for `plugins.security.nodes_dn` to limit which certificates are accepted for node-to-node communication.","status":"published","published":"2026-05-07T00:09:18Z","modified":"2026-05-07T00:09:21Z","cvss":[{"version":"3.1","score":2.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:40:02.883746Z"}],"osv":[{"id":"GHSA-x5hg-x4gv-j98m","title":"OpenSearch has ineffective TLS certificate hostname verification","description":"### Description\n\nA regression was introduced in OpenSearch 2.18.0 that caused the `plugins.security.ssl.transport.enforce_hostname_verification` setting to be ineffective. When this setting was enabled, OpenSearch did not verify that the hostname in a connecting node's TLS certificate matched the hostname of the connection. This could allow a node with a valid certificate (signed by the cluster's trusted CA) but an incorrect hostname SAN to join the cluster.\n\n### Impact\n\nClusters running affected versions with hostname verification enabled did not receive the expected protection from this setting. A node presenting a certificate signed by the cluster's trusted CA could join the cluster regardless of whether its hostname SAN matched. This regression does not affect certificate validation itself — only the additional hostname verification check.\n\n### Patches\n\nThis issue is fixed in OpenSearch 2.19.4 and 3.3.0.\n\n### Workarounds\n\nUse more restrictive values for `plugins.security.nodes_dn` to limit which certificates are accepted for node-to-node communication.","status":"published","published":"2026-05-07T00:09:18Z","modified":"2026-05-07T00:21:11.903034Z","cvss":[{"version":"3.1","score":2.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:46:59.484835Z"}]}}