OpenSearch has a bypass of REST Layer Authorization Using Malformed Paths

Description A flaw was identified in the OpenSearch REST layer that could allow authorization checks to be bypassed when processing certain malformed HTTP requests. This could permit unauthorized access to restricted API endpoints in environments that rely on REST-layer authorization...

PT-2026-41480

Name of the Vulnerable Software and Affected Versions opensearch versions prior to 2.19.0 opensearch-ingest-attachment-plugin affected versions not specified opensearch-mapper-annotated-text-plugin affected versions not specified opensearch-mapper-murmur3-plugin affected versions not specified...

PT-2026-56045

Уязвимость плагина безопасности программного пакета OpenSearch связана с недостатками процедуры авторизации. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, повысить свои привилегии...

PT-2026-56048

Уязвимость компонента DLS программного пакета OpenSearch связана с недостатками процедуры авторизации. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, получить несанкционированный доступ к защищаемой информации...

PT-2026-41472

Name of the Vulnerable Software and Affected Versions OpenSearch versions prior to 2.19.4 OpenSearch versions prior to 3.2.0 Description A flaw in the OpenSearch Security plugin occurs during the handling of index rollover requests. When a request includes an explicit target index name, the...

PT-2026-56047

Уязвимость модуля валидации TLS-сертификатов программного пакета OpenSearch связана с ошибками процедуры подтверждения подлинности сертификата. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, обойти существующие ограничения безопасности...

GHSA-62HF-57XW-28J9 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, opensearch-dashboards-fips, lerna, kibana, awx, arangodb, langfuse-fips, langfuse, prism, saf, nextcloud-server, redisinsight, jitsucom-jitsu, kubeflow-katib, gitlab-rails-ce, wazuh-dashboard, kubeflow-centraldashboard, wazuh-dashboard-fips,...

GHSA-6CHQ-WFR3-2HJ9 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, opensearch-dashboards-fips, lerna, kibana, awx, arangodb, langfuse-fips, langfuse, prism, saf, nextcloud-server, redisinsight, jitsucom-jitsu, kubeflow-katib, gitlab-rails-ce, wazuh-dashboard, kubeflow-centraldashboard, wazuh-dashboard-fips,...

GHSA-PF86-5X62-JRWF vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, opensearch-dashboards-fips, lerna, kibana, awx, arangodb, langfuse-fips, langfuse, prism, saf, nextcloud-server, redisinsight, jitsucom-jitsu, kubeflow-katib, gitlab-rails-ce, wazuh-dashboard, kubeflow-centraldashboard, wazuh-dashboard-fips,...

GHSA-PMWG-CVHR-8VH7 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, opensearch-dashboards-fips, lerna, kibana, awx, arangodb, langfuse-fips, langfuse, prism, saf, nextcloud-server, redisinsight, jitsucom-jitsu, kubeflow-katib, gitlab-rails-ce, wazuh-dashboard, kubeflow-centraldashboard, wazuh-dashboard-fips,...

GHSA-VF2M-468P-8V99 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, opensearch-dashboards-fips, lerna, kibana, awx, arangodb, langfuse-fips, langfuse, prism, saf, nextcloud-server, redisinsight, jitsucom-jitsu, kubeflow-katib, gitlab-rails-ce, wazuh-dashboard, kubeflow-centraldashboard, wazuh-dashboard-fips,...

GHSA-W9J2-PVGH-6H63 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, opensearch-dashboards-fips, lerna, kibana, awx, arangodb, langfuse-fips, langfuse, prism, saf, nextcloud-server, redisinsight, jitsucom-jitsu, kubeflow-katib, gitlab-rails-ce, wazuh-dashboard, kubeflow-centraldashboard, wazuh-dashboard-fips,...

GHSA-XX6V-RP6X-Q39C vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, opensearch-dashboards-fips, lerna, kibana, awx, arangodb, langfuse-fips, langfuse, prism, saf, nextcloud-server, redisinsight, jitsucom-jitsu, kubeflow-katib, gitlab-rails-ce, wazuh-dashboard, kubeflow-centraldashboard, wazuh-dashboard-fips,...

GHSA-5C9X-8GCM-MPGX vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, opensearch-dashboards-fips, lerna, kibana, awx, arangodb, langfuse-fips, langfuse, prism, saf, nextcloud-server, redisinsight, jitsucom-jitsu, kubeflow-katib, gitlab-rails-ce, wazuh-dashboard, kubeflow-centraldashboard, wazuh-dashboard-fips,...

GHSA-M7PR-HJQH-92CM vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, opensearch-dashboards-fips, lerna, kibana, awx, arangodb, langfuse-fips, langfuse, prism, saf, nextcloud-server, redisinsight, jitsucom-jitsu, kubeflow-katib, gitlab-rails-ce, wazuh-dashboard, kubeflow-centraldashboard, wazuh-dashboard-fips,...

GHSA-XHJH-PMCV-23JW vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, opensearch-dashboards-fips, lerna, kibana, awx, arangodb, langfuse-fips, langfuse, prism, saf, nextcloud-server, redisinsight, jitsucom-jitsu, kubeflow-katib, gitlab-rails-ce, wazuh-dashboard, kubeflow-centraldashboard, wazuh-dashboard-fips,...

GHSA-3W6X-2G7M-8V23 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, opensearch-dashboards-fips, lerna, kibana, awx, langfuse-fips, prism, langfuse, saf, nextcloud-server, redisinsight, jitsucom-jitsu, kubeflow-katib, librechat, gitlab-rails-ce, wazuh-dashboard, kubeflow-centraldashboard, wazuh-dashboard-fips,...

GHSA-445Q-VR5W-6Q77 vulnerabilities

Vulnerabilities for packages: redisinsight, opensearch-dashboards, wazuh-dashboard, nextcloud-server, jitsucom-jitsu, opensearch-dashboards-fips, lerna, kibana, kubeflow-centraldashboard, gitlab-rails-ce, awx, langfuse-fips, prism, langfuse, saf, wazuh-dashboard-fips, gitlab-rails-ce-fips,...

CVE-2026-41324 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard, opensearch-dashboards, opensearch-dashboards-fips, kibana, code-server...

CVE-2026-41907 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, renovate, opensearch-dashboards-fips, kibana, kubeflow-pipelines, argo-workflows, arangodb, langfuse, langfuse-fips, azurite, prism, saf, nextcloud-server, gemini-cli, commercial-gitlab-rails-ee, redisinsight, tensorflow-cpu-jupyter, homepage,...