Vulnerability record · CVE-2022-41918 · published 15 November 2022

CVE-2022-41918: Amazon opensearch incorrect authorization vulnerability

Amazon · Opensearch

OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the indices that back data streams potentially leading to incorrect access authorization. OpenSearch 1.3.7 and 2.4.0 contain a fix for this issue. Users are advised to update. There are no known workarounds for this issue.

6.3 CVSS 3.1 Medium EPSS 0.47% · top 62.0% CWE-612 · CWE-612CWE-863 · Incorrect authorization

6.3CVSS 3.1 base score

0.47%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Opensearch Amazon

References

Link	Tags
https://github.com/opensearch-project/security/commit/f7cc569c9d3fa5d5432c76c854eed280d45ce6f4	PatchThird Party Advisory
https://github.com/opensearch-project/security/security/advisories/GHSA-wmx7-x4jp-9jgg	Third Party Advisory
https://github.com/opensearch-project/security/commit/f7cc569c9d3fa5d5432c76c854eed280d45ce6f4	PatchThird Party Advisory
https://github.com/opensearch-project/security/security/advisories/GHSA-wmx7-x4jp-9jgg	Third Party Advisory

Track CVE-2022-41918 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2023-23612Amazon opensearch improper authentication vulnerabilityOpenSearch is an open source distributed and RESTful search engine. OpenSearch uses JWTs to store role claims obtained from the Identity Provider (Id…EPSS 0.80%26 Jan 2023 8.8CVE-2022-31115Amazon opensearch deserialization of untrusted data vulnerabilityopensearch-ruby is a community-driven, open source fork of elasticsearch-ruby. In versions prior to 2.0.1 the ruby `YAML.load` function was used inst…EPSS 1.6%30 Jun 2022 8.3CVE-2025-9624Amazon opensearch vulnerabilityA vulnerability in OpenSearch allows attackers to cause Denial of Service (DoS) by submitting complex query_string inputs. This issue affects all Ope…EPSS 0.51%25 Nov 2025 7.5CVE-2022-35980Amazon opensearch vulnerabilityOpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. Versions 2.0.0.0 and 2.1.0.0 of the security…EPSS 1.2%12 Aug 2022 6.5CVE-2023-23613Amazon opensearch information exposure vulnerabilityOpenSearch is an open source distributed and RESTful search engine. In affected versions there is an issue in the implementation of field-level secur…EPSS 0.82%26 Jan 2023 5.9CVE-2023-31141Amazon opensearch incorrect authorization vulnerabilityOpenSearch is open-source software suite for search, analytics, and observability applications. Prior to versions 1.3.10 and 2.7.0, there is an issue…EPSS 0.46%8 May 2023 5.4CVE-2023-45807Amazon opensearch vulnerabilityOpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 2021. There is an issue with the…EPSS 0.41%16 Oct 2023 5.3CVE-2023-25806Amazon opensearch observable discrepancy vulnerabilityOpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. There is an observable discrepancy in the au…EPSS 0.33%2 Mar 2023

Source: NIST National Vulnerability Database (record CVE-2022-41918), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.