CVE-2022-41918 Issue with fine-grained access control of indices backing data streams
Attackers can bypass fine-grained access controls on data stream indices, potentially reading unauthorized data in OpenSearch deployments.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-41918?
CVE-2022-41918 is a medium-severity missing authorization vulnerability in opensearch-project security, published on 15 Nov 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the indices that back data streams potentially leading to incorrect access authorization. OpenSearch 1.3.7 and 2.4.0 contain a fix for this issue. Users are advised to update. There are no known workarounds for this issue.
Which versions are affected by CVE-2022-41918?
4 open source packages ship an affected version, including org.opensearch.plugin:opensearch-security. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.opensearch.plugin:opensearch-security Maven | All versions | 1.3.7 |
org.opensearch.plugin:opensearch-security Maven | All versions | 1.3.7 |
org.opensearch.plugin:opensearch-security Maven | From 2.0.0 | 2.4.0 |
org.opensearch.plugin:opensearch-security Maven | From 2.0.0 | 2.4.0 |
Products include Amazon Opensearch.
How do I fix CVE-2022-41918?
Upgrade org.opensearch.plugin:opensearch-security to a fixed version for your release line: 1.3.7 or 2.4.0.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-41918 being exploited?
There is no known exploitation of CVE-2022-41918 in the wild and no public exploit code.
Other vulnerabilities in opensearch-project security
- CVE-2022-31115 Unsafe YAML deserialization in opensearch-ruby
- CVE-2025-9624 OpenSearch 3.2.0 - Nested Boolean/Disjunction asymmetric DoS
- CVE-2022-35980 OpenSearch vulnerable to Improper Authorization of Index Containing Sensitive Information
- CVE-2023-23933 Issue in Anomaly Detection with document and field level rules in numerical feature aggregations
- CVE-2023-23613 Field-level security issue with .keyword fields in OpenSearch
Sources
Also known as GHSA-wmx7-x4jp-9jgg.