What’s Vulnerable › Products

AWS Opensearch vulnerabilities

15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Check whether your AWS Opensearch version is affected

Latest AWS Opensearch vulnerabilities

• CVE-2026-83497 — Unrestricted Java Deserialization in OpenSearch SQL Plugin Cursor Pagination (CVSS 8.8)
• CVE-2026-18428 — SQL Query Validation Bypass in OpenSearch Direct Query (CVSS 8.8)
• CVE-2026-19311 — Missing Authorization in Execute Monitor API in OpenSearch Alerting Plugin (CVSS 8.1)
• CVE-2026-18952 — Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics Plugin (CVSS 8.1)
• CVE-2025-9624 — OpenSearch 3.2.0 - Nested Boolean/Disjunction asymmetric DoS (CVSS 7.5)
• CVE-2023-45807 — OpenSearch Issue with tenant read-only permissions (CVSS 5.4)
• CVE-2023-31141 — OpenSearch issue with fine-grained access control during extremely rare race conditions (CVSS 5.9)
• CVE-2023-25806 — Time discrepancy in authentication responses in OpenSearch (CVSS 5.3)
• CVE-2023-23933 — Issue in Anomaly Detection with document and field level rules in numerical feature aggregations (CVSS 4.3)
• CVE-2023-23613 — Field-level security issue with .keyword fields in OpenSearch (CVSS 6.5)
• CVE-2023-23612 — Issue with whitespace in JWT roles in OpenSearch (CVSS 8.8)
• CVE-2022-41917 — Incorrect Error Handling Allowed Partial File Reads Over REST API in OpenSearch (CVSS 4.3)
• CVE-2022-41918 — Issue with fine-grained access control of indices backing data streams (CVSS 6.3)
• CVE-2022-35980 — OpenSearch vulnerable to Improper Authorization of Index Containing Sensitive Information (CVSS 7.5)
• CVE-2022-31115 — Unsafe YAML deserialization in opensearch-ruby (CVSS 8.8)