Opensearch-project vulnerabilities

Products

• Security 7
• Data-prepper 2
• Notifications 2

Newest

• @mikro-orm sql OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution CVE-2026-63393 8.7 HighOctober 30, 2026
• amazon opensearch data prepper, opensearch-project data-prepper +1 more OpenSearch Data Prepper plugins trusts all SSL certificates by default CVE-2025-62371 Fix available 7.4 HighOctober 15, 2025
• amazon opensearch data prepper, opensearch-project data-prepper +1 more OpenTelemetry Logs source may lack authentication with some custom plugins CVE-2024-55886 6.9 MediumDecember 12, 2024
• opensearch-project security-dashboards-plugin OpenSearch Dashboards Security Plugin improper validation of nextUrl can lead to external redirect CVE-2024-43794 6.1 MediumAugust 23, 2024
• opensearch-project reporting, opensearch observability +1 more OpenSearch Dashboards Reports does not properly restrict access to private tenant resources CVE-2024-39900 Fix available 5.4 MediumJuly 9, 2024
• opensearch observability OpenSearch Observability does not properly restrict access to private tenant resources CVE-2024-39901 Fix available 4.2 MediumJuly 9, 2024
• amazon opensearch, embysupport security +1 more OpenSearch Issue with tenant read-only permissions CVE-2023-45807 Fix available 5.4 MediumOctober 16, 2023
• cloud foundry cf-nfs-volume release, notifications, smb-volume release +3 more +5 more CF workflows leak credentials in system audit logs CVE-2023-20885 6.5 MediumJune 16, 2023
• amazon opensearch, embysupport security, amazon opensearch security +2 more OpenSearch issue with fine-grained access control during extremely rare race conditions CVE-2023-31141 Fix available 4.8 MediumMay 8, 2023
• amazon opensearch, opensearch security, embysupport security +2 more Time discrepancy in authentication responses in OpenSearch CVE-2023-25806 Fix available 5.3 MediumMarch 2, 2023
• amazon opensearch, opensearch-project anomaly-detection +1 more Issue in Anomaly Detection with document and field level rules in numerical feature aggregations CVE-2023-23933 5.7 MediumFebruary 3, 2023
• amazon opensearch, embysupport security +1 more Issue with whitespace in JWT roles in OpenSearch CVE-2023-23612 Fix available 4.7 MediumJanuary 24, 2023
• amazon opensearch, embysupport security +1 more Field-level security issue with .keyword fields in OpenSearch CVE-2023-23613 Fix available 5.7 MediumJanuary 24, 2023
• amazon opensearch, embysupport security +1 more Issue with fine-grained access control of indices backing data streams CVE-2022-41918 Fix available 6.3 MediumNovember 15, 2022
• amazon opensearch Incorrect Error Handling Allowed Partial File Reads Over REST API in OpenSearch CVE-2022-41917 4.3 MediumNovember 15, 2022
• amazon opensearch notifications, opensearch-project notifications +1 more OpenSearch Notifications is vulnerable to Server-Side Request Forgery (SSRF) CVE-2022-41906 7.7 HighNovember 11, 2022
• amazon opensearch, embysupport security +1 more OpenSearch vulnerable to Improper Authorization of Index Containing Sensitive Information CVE-2022-35980 Fix available 7.5 HighAugust 12, 2022
• amazon opensearch, opensearch-project opensearch-ruby +1 more Unsafe YAML deserialization in opensearch-ruby CVE-2022-31115 Fix available 8.8 HighJune 30, 2022