Executive brief
OpenSearch has a bypass of REST Layer Authorization Using Malformed Paths
Affected products
- Maven org.opensearch.plugin:opensearch-security
Junglewise Threat Intelligence
OpenSearch has a bypass of REST Layer Authorization Using Malformed Paths
Severity: low · CVSS 3.1 · Published 2026-05-07
Technologies: org.opensearch.plugin:opensearch-security (Maven). Vendors: Maven.
Related threats
- OpenSearch unauthorized data access on fields protected by field level security if field is a member of an object
- OpenSearch unauthorized data access on fields protected by field masking for fields of type ip, geo_point, geo_shape, xy_point, xy_shape
- OpenSearch vulnerable to Improper Authorization of Index Containing Sensitive Information