| GHSA-x5hg-x4gv-j98m | THẤP2.2 | OpenSearch has ineffective TLS certificate hostname verification | 07/05/2026 |
| GHSA-x83w-23jp-g6pw | TRUNG BÌNH5.3 | OpenSearch Security plugin: DLS not applied on documents linked by has_child or has_parent relation | 07/05/2026 |
| GHSA-22vx-2x23-98w6 | THẤP2.2 | OpenSearch vulnerable to improper authorization for Rollover Requests | 07/05/2026 |
| GHSA-83x9-vc3c-hghc | THẤP3.7 | OpenSearch has a bypass of REST Layer Authorization Using Malformed Paths | 07/05/2026 |
| GHSA-2rjv-cv85-xhgm | TRUNG BÌNH5.7 | OpenSearch unauthorized data access on fields protected by field level security if field is a member of an object | 01/08/2025 |
| GHSA-rrmm-wq7q-h4v5 | TRUNG BÌNH5.7 | OpenSearch unauthorized data access on fields protected by field masking for fields of type ip, geo_point, geo_shape, xy_point, xy_shape | 01/08/2025 |
| GHSA-8wx3-324g-w4qq | CAO7.5 | OpenSearch uncontrolled resource consumption | 17/10/2023 |
| CVE-2023-45807 | TRUNG BÌNH5.4 | OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 2021. There is an issue with the implementation of tenant permissions in OpenSearch Dashboards where authenticated users with read-only access to a tenant can perform create, edit and delete operations o | 16/10/2023 |
| CVE-2023-31141 | TRUNG BÌNH5.9 | OpenSearch is open-source software suite for search, analytics, and observability applications. Prior to versions 1.3.10 and 2.7.0, there is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the | 08/05/2023 |
| CVE-2023-25806 | TRUNG BÌNH5.3 | OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issue only affects calls using the internal basic identity provid | 02/03/2023 |
| CVE-2023-23613 | TRUNG BÌNH6.5 | OpenSearch is an open source distributed and RESTful search engine. In affected versions there is an issue in the implementation of field-level security (FLS) and field masking where rules written to explicitly exclude fields are not correctly applied for certain queries that rely on their auto-generated .keyword field | 26/01/2023 |
| CVE-2023-23612 | CAO8.8 | OpenSearch is an open source distributed and RESTful search engine. OpenSearch uses JWTs to store role claims obtained from the Identity Provider (IdP) when the authentication backend is SAML or OpenID Connect. There is an issue in how those claims are processed from the JWTs where the leading and trailing whitespace i | 26/01/2023 |
| CVE-2022-41918 | TRUNG BÌNH6.3 | OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the indices that back data streams potentially leading | 15/11/2022 |
| CVE-2022-35980 | CAO7.5 | OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. Versions 2.0.0.0 and 2.1.0.0 of the security plugin are affected by an information disclosure vulnerability. Requests to an OpenSearch cluster configured with advanced access control features document level security | 12/08/2022 |