Field-level security issue with .keyword fields in OpenSearch
Advisory title: Field-level security issue with .keyword fields
Affected versions:
OpenSearch 1.0.0-1.3.7 and 2.0.0-2.4.1
Patched versions:
OpenSearch 1.3.8 and 2.5.0
Impact:
There is an issue in the implementation of field-level security (FLS) and field masking where rules written to explicitly exclude fields are not correctly applied for certain queries that rely on their auto-generated .keyword fields.
This issue is only present for authenticated users with read access to the indexes containing the restricted fields.
Workaround:
FLS rules that use explicit exclusions can be written to grant explicit access instead. Policies authored in this way are not subject to this issue.
Patches:
OpenSearch versions 1.3.8 and 2.5.0 contain a fix for this issue.
For more information:
If you have any questions or comments about this advisory, please contact AWS/Amazon Security via our issue reporting page (https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Java / Kotlin (Maven) | org.opensearch.plugin:opensearch-security | < 1.3.8, >= 2.0.0, < 2.5.0 | 1.3.8, 2.5.0 |
Referencias
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N- Debilidad (CWE)
CWE-200- Plataforma
- Java / Kotlin (Maven)
- Paquete
org.opensearch.plugin:opensearch-security- Publicada
- 24.01.2023
- Actualizado
- 11.10.2026 13:19
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-v3cg-7r9h-r2g6 - CC BY 4.0
Historial de vulnerabilidades: org.opensearch.plugin:opensearch-security
Todas las vulnerabilidades publicadas de este paquete (Java / Kotlin (Maven)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 14
- Primera → última
- 08.2022 05.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 2
- Media 9
- Baja 3
Divulgaciones por año
- 2022: 1
- 2023: 7
- 2024: 0
- 2025: 2
- 2026: 4
-
Field-level security issue with .keyword fields in OpenSearch esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.