Read the docs
TI-2023-14851 Aliases CVE-2023-31141GHSA-g8xc-6mf7-h28h

OpenSearch issue with fine-grained access control during extremely rare race conditions

Priority LOW 27CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

OpenSearch is open-source software suite for search, analytics, and observability applications. Prior to versions 1.3.10 and 2.7.0, there is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the queries during extremely rare race conditions potentially leading to incorrect access authorization. For this issue to be triggered, two concurrent requests need to land on the same instance exactly when query cache eviction happens, once every four hours. OpenSearch 1.3.10 and 2.7.0 contain a fix for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0046 40th percentileScored 2026-11-07
Fix Fixed security (opensearch-project): 1.3.10, 2.7.0org.opensearch.plugin:opensearch-security (Maven): 1.3.10.0, 2.7.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AWSsecurity1.0.0 to before 1.3.10; 2.0.0 to before 2.7.01.3.10, 2.7.0Patch availableCNA
—org.opensearch.plugin:opensearch-security (Maven)1.0.0 to before 1.3.10.01.3.10.0Patch availableGHSA-g8xc-6mf7-h28h
—org.opensearch.plugin:opensearch-security (Maven)2.0.0 to before 2.7.0.02.7.0.0Patch availableGHSA-g8xc-6mf7-h28h
  • security VendorAWS Affected 1.0.0 to before 1.3.10; 2.0.0 to before 2.7.0 Fixed in 1.3.10, 2.7.0 Patch available CNA
  • org.opensearch.plugin:opensearch-security (Maven) Vendor— Affected 1.0.0 to before 1.3.10.0 Fixed in 1.3.10.0 Patch available GHSA-g8xc-6mf7-h28h
  • org.opensearch.plugin:opensearch-security (Maven) Vendor— Affected 2.0.0 to before 2.7.0.0 Fixed in 2.7.0.0 Patch available GHSA-g8xc-6mf7-h28h

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:amazon:opensearch:*:*:*:*:*:docker:*:*before 1.3.10; 2.0.0 to before 2.7.0VulnerableAWS
cpe:2.3:a:amazon:opensearch_security:*:*:*:*:*:*:*:*before 1.3.10; 2.0.0 to before 2.7.0VulnerableAWS
  • cpe:2.3:a:amazon:opensearch:*:*:*:*:*:docker:*:* Versions before 1.3.10; 2.0.0 to before 2.7.0 Vulnerable ·AWS
  • cpe:2.3:a:amazon:opensearch_security:*:*:*:*:*:*:*:* Versions before 1.3.10; 2.0.0 to before 2.7.0 Vulnerable ·AWS

Remediation

  • Fix · CNA security (opensearch-project) Fixed in 1.3.10, 2.7.0
  • Fix · GHSA-g8xc-6mf7-h28h org.opensearch.plugin:opensearch-security (Maven) Fixed in 1.3.10.0 Advisory →
  • Fix · GHSA-g8xc-6mf7-h28h org.opensearch.plugin:opensearch-security (Maven) Fixed in 2.7.0.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-31141
  2. 2026-10-03 Alias added: GHSA-g8xc-6mf7-h28h

References

Advisory 2

Other 1

  • TI-2022-13159 Unsafe YAML deserialization in opensearch-ruby CVSS 3.1HIGH 8.8
  • TI-2025-08817 OpenSearch 3.2.0 - Nested Boolean/Disjunction asymmetric DoS CVSS 4.0HIGH 8.3
  • TI-2022-16405 OpenSearch vulnerable to Improper Authorization of Index Containing Sensitive Information CVSS 3.1HIGH 7.5
  • TI-2023-09441 Issue with whitespace in JWT roles in OpenSearch CVSS 3.1HIGH 8.8
  • TI-2023-11077 Time discrepancy in authentication responses in OpenSearch CVSS 3.1MEDIUM 5.3
  • TI-2023-09442 Field-level security issue with .keyword fields in OpenSearch CVSS 3.1MEDIUM 6.5
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences