PT-2026-41510 · Redsoft+1 · Opensearch+9

Published 2026-05-07 · Updated 2026-05-29

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenSearch versions prior to 2.19.4 OpenSearch versions prior to 3.2.0

Description A flaw exists in the OpenSearch Security plugin's document-level security (DLS) implementation. DLS restrictions are not correctly applied to search queries utilizing has parent or has child join relations. This allows an authenticated user to bypass DLS rules and access restricted document contents in clusters that use both DLS and the join field type on the same index.

Recommendations Update to version 2.19.4. Update to version 3.2.0. Avoid using the join field type on indices that are subject to DLS rules.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

GHSA-X83W-23JP-G6PW

Affected Products

Opensearch

Opensearch-Ingest-Attachment-Plugin

Opensearch-Mapper-Annotated-Text-Plugin

Opensearch-Mapper-Murmur3-Plugin

Opensearch-Mapper-Size-Plugin

Opensearch-Repository-Hdfs-Plugin

Opensearch-Repository-S3-Plugin

Opensearch-Store-Mb-Plugin

Opensearch-Transport-Nio-Plugin

Org.Opensearch.Plugin:Opensearch-Security

References · 5

• https://osv.dev/vulnerability/GHSA-x83w-23jp-g6pw · Vendor Advisory
• https://github.com/opensearch-project/security · Note
• https://github.com/opensearch-project/security/security/advisories/GHSA-x83w-23jp-g6pw · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-opensearch-ghsa-x83w-23jp-g6pw-8.0 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-opensearch-ghsa-x83w-23jp-g6pw-7.3 · Note