Issue with whitespace in JWT roles in OpenSearch
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass, Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-287 and CWE-269.
Summary
OpenSearch is an open source distributed and RESTful search engine. OpenSearch uses JWTs to store role claims obtained from the Identity Provider (IdP) when the authentication backend is SAML or OpenID Connect. There is an issue in how those claims are processed from the JWTs where the leading and trailing whitespace is trimmed, allowing users to potentially claim roles they are not assigned to if any role matches the whitespace-stripped version of the roles they are a member of. This issue is only present for authenticated users, and it requires either the existence of roles that match, not considering leading/trailing whitespace, or the ability for users to create said matching roles. In addition, the Identity Provider must allow leading and trailing spaces in role names. OpenSearch 1.0.0-1.3.7 and 2.0.0-2.4.1 are affected. Users are advised to upgrade to OpenSearch 1.3.8 or 2.5.0. There are no known workarounds for this issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AWS | security | 2.0.0 to before 2.5.0; before 1.3.8 | 2.5.0, 1.3.8 | Patch available | CNA |
| — | org.opensearch.plugin:opensearch-security (Maven) | before 1.3.8 | 1.3.8 | Patch available | GHSA-864v-6qj7-62qj |
| — | org.opensearch.plugin:opensearch-security (Maven) | 2.0.0 to before 2.5.0 | 2.5.0 | Patch available | GHSA-864v-6qj7-62qj |
- security VendorAWS Affected 2.0.0 to before 2.5.0; before 1.3.8 Fixed in 2.5.0, 1.3.8 Patch available CNA
- org.opensearch.plugin:opensearch-security (Maven) Vendor— Affected before 1.3.8 Fixed in 1.3.8 Patch available GHSA-864v-6qj7-62qj
- org.opensearch.plugin:opensearch-security (Maven) Vendor— Affected 2.0.0 to before 2.5.0 Fixed in 2.5.0 Patch available GHSA-864v-6qj7-62qj
Remediation
- Fix · CNA security (opensearch-project) Fixed in 2.5.0, 1.3.8
- Fix · GHSA-864v-6qj7-62qj org.opensearch.plugin:opensearch-security (Maven) Fixed in 1.3.8 Advisory →
- Fix · GHSA-864v-6qj7-62qj org.opensearch.plugin:opensearch-security (Maven) Fixed in 2.5.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-23612
- 2026-10-03 Alias added: GHSA-864v-6qj7-62qj
- 2026-11-05 Priority changed: LOW → MEDIUM
References
More AWS Opensearch vulnerabilities
- TI-2022-13159 Unsafe YAML deserialization in opensearch-ruby CVSS 3.1HIGH 8.8
- TI-2025-08817 OpenSearch 3.2.0 - Nested Boolean/Disjunction asymmetric DoS CVSS 4.0HIGH 8.3
- TI-2022-16405 OpenSearch vulnerable to Improper Authorization of Index Containing Sensitive Information CVSS 3.1HIGH 7.5
- TI-2023-11077 Time discrepancy in authentication responses in OpenSearch CVSS 3.1MEDIUM 5.3
- TI-2023-09442 Field-level security issue with .keyword fields in OpenSearch CVSS 3.1MEDIUM 6.5
- TI-2022-20259 Issue with fine-grained access control of indices backing data streams CVSS 3.1MEDIUM 6.3
Sources
- CVE-2023-23612 · CVE Program
- CVE-2023-23612 · NVD
- FIRST EPSS
- GHSA-864v-6qj7-62qj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences