Amazon Opensearch vulnerabilities

• opensearch, amazon opensearch service, aws amazon opensearch service +2 more Unrestricted Java Deserialization in OpenSearch SQL Plugin Cursor Pagination CVE-2026-83497 8.7 HighAugust 31, 2026
• amazon opensearch OpenSearch 3.2.0 - Nested Boolean/Disjunction asymmetric DoS CVE-2025-9624 Fix available 8.3 HighNovember 25, 2025
• amazon opensearch data prepper, opensearch-project data-prepper +1 more OpenSearch Data Prepper plugins trusts all SSL certificates by default CVE-2025-62371 Fix available 7.4 HighOctober 15, 2025
• amazon opensearch data prepper, opensearch-project data-prepper +1 more OpenTelemetry Logs source may lack authentication with some custom plugins CVE-2024-55886 6.9 MediumDecember 12, 2024
• amazon opensearch, embysupport security +1 more OpenSearch Issue with tenant read-only permissions CVE-2023-45807 Fix available 5.4 MediumOctober 16, 2023
• eclipse jetty, ietf http, http/2 +166 more +168 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2023-44487 In KEVPublic exploitFix available EPSS 100.0% 7.5 HighJuly 10, 2023
• amazon opensearch, embysupport security, amazon opensearch security +2 more OpenSearch issue with fine-grained access control during extremely rare race conditions CVE-2023-31141 Fix available 4.8 MediumMay 8, 2023
• amazon opensearch, opensearch security, embysupport security +2 more Time discrepancy in authentication responses in OpenSearch CVE-2023-25806 Fix available 5.3 MediumMarch 2, 2023
• amazon opensearch, opensearch-project anomaly-detection +1 more Issue in Anomaly Detection with document and field level rules in numerical feature aggregations CVE-2023-23933 5.7 MediumFebruary 3, 2023
• amazon opensearch, embysupport security +1 more Issue with whitespace in JWT roles in OpenSearch CVE-2023-23612 Fix available 4.7 MediumJanuary 24, 2023
• amazon opensearch, embysupport security +1 more Field-level security issue with .keyword fields in OpenSearch CVE-2023-23613 Fix available 5.7 MediumJanuary 24, 2023
• amazon opensearch, embysupport security +1 more Issue with fine-grained access control of indices backing data streams CVE-2022-41918 Fix available 6.3 MediumNovember 15, 2022
• amazon opensearch Incorrect Error Handling Allowed Partial File Reads Over REST API in OpenSearch CVE-2022-41917 4.3 MediumNovember 15, 2022
• amazon opensearch notifications, opensearch-project notifications +1 more OpenSearch Notifications is vulnerable to Server-Side Request Forgery (SSRF) CVE-2022-41906 7.7 HighNovember 11, 2022
• amazon opensearch, embysupport security +1 more OpenSearch vulnerable to Improper Authorization of Index Containing Sensitive Information CVE-2022-35980 Fix available 7.5 HighAugust 12, 2022
• amazon opensearch, opensearch-project opensearch-ruby +1 more Unsafe YAML deserialization in opensearch-ruby CVE-2022-31115 Fix available 8.8 HighJune 30, 2022
• amazon aws opensearch The CLI 1.0.0 for Amazon AWS OpenSearch has weak permissions for the configuration file. CVE-2021-44833 9.8 CriticalDecember 12, 2021