en
The OpenSearch Project is a community-driven, open-source project in search and data analytics. Its mission is to provide an Apache 2.0-licensed suite for ingesting, searching, visualizing, and analyzing data, with capabilities spanning observability, security analytics, vector search, and extensible plugins. It operates as a global open-source community rather than a conventional commercial provider.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2025-62371OpenSearch Data Prepper plugins trusts all SSL certificates by defaultCVE-2024-55886OpenTelemetry Logs source may lack authentication with some custom pluginsCVE-2024-43794OpenSearch Dashboards Security Plugin improper validation of nextUrl can lead to external redirectCVE-2024-39900OpenSearch Dashboards Reports does not properly restrict access to private tenant resourcesCVE-2024-39901OpenSearch Observability does not properly restrict access to private tenant resources| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2025-62371OpenSearch Data Prepper plugins trusts all SSL certificates by default | Exploitation statusNot exploited | FixYes |
| Published10/15/2025 |
| SeverityHigh |
CVE-2024-55886OpenTelemetry Logs source may lack authentication with some custom plugins | Exploitation statusNot exploited | FixNo | Affected productdata-prepper | Published12/12/2024 | SeverityMedium |
|---|
CVE-2024-43794OpenSearch Dashboards Security Plugin improper validation of nextUrl can lead to external redirect | Exploitation statusNot exploited | FixYes | Affected productsecurity-dashboards-plugin | Published08/23/2024 | SeverityMedium |
|---|
CVE-2024-39900OpenSearch Dashboards Reports does not properly restrict access to private tenant resources | Exploitation statusNot exploited | FixNo | Affected productreporting | Published07/09/2024 | SeverityMedium |
|---|
CVE-2024-39901OpenSearch Observability does not properly restrict access to private tenant resources | Exploitation statusNot exploited | FixNo | Affected productobservability | Published07/09/2024 | SeverityMedium |
|---|
CVE-2023-45807OpenSearch Issue with tenant read-only permissions | Exploitation statusNot exploited | FixNo | Affected productsecurity | Published10/16/2023 | SeverityMedium |
|---|
CVE-2023-31141OpenSearch issue with fine-grained access control during extremely rare race conditions | Exploitation statusNot exploited | FixNo | Affected productsecurity | Published05/08/2023 | SeverityMedium |
|---|
CVE-2023-25806Time discrepancy in authentication responses in OpenSearch | Exploitation statusNot exploited | FixNo | Affected productsecurity | Published03/02/2023 | SeverityMedium |
|---|
CVE-2023-23933Issue in Anomaly Detection with document and field level rules in numerical feature aggregations | Exploitation statusNot exploited | FixYes | Affected productanomaly-detection | Published02/03/2023 | SeverityMedium |
|---|
CVE-2023-23612Issue with whitespace in JWT roles in OpenSearch | Exploitation statusNot exploited | FixNo | Affected productsecurity | Published01/24/2023 | SeverityMedium |
|---|
16 Results | Page 1 of 2