GHSA-22vx-2x23-98w6 OpenSearch vulnerable to improper authorization for Rollover Requests
Users with rollover permissions can create unauthorized indices by bypassing access controls on target index names.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-22vx-2x23-98w6?
GHSA-22vx-2x23-98w6 is a missing authorization vulnerability in org.opensearch.plugin:opensearch-security, published on 7 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Description
A flaw was identified in the OpenSearch Security plugin's handling of index rollover requests. When a rollover request included an explicit target index name, the security plugin did not properly evaluate access control permissions against the target index. This could allow a user with rollover permissions on a source index to create a new index with a name they are not authorized to use.
Impact
A user with indices:admin/rollover permission on a source index pattern could roll over to a target index name outside their authorized index patterns. This is limited to index creation via the rollover API and requires the user to already have rollover privileges on the source index.
Patches
This issue is fixed in OpenSearch 2.19.4 and 3.2.0
Workarounds
Grant the indices:admin/rollover permission only to fully trusted users.
Which versions are affected by GHSA-22vx-2x23-98w6?
4 open source packages ship an affected version, including org.opensearch.plugin:opensearch-security.
| Package | Affected | Fixed in |
|---|---|---|
org.opensearch.plugin:opensearch-security Maven | From 1.0.0 | 2.19.4.0 |
org.opensearch.plugin:opensearch-security Maven | From 1.0.0 | 2.19.4.0 |
org.opensearch.plugin:opensearch-security Maven | From 3.0.0 | 3.2.0.0 |
org.opensearch.plugin:opensearch-security Maven | From 3.0.0 | 3.2.0.0 |
How do I fix GHSA-22vx-2x23-98w6?
Upgrade org.opensearch.plugin:opensearch-security to a fixed version for your release line: 2.19.4.0 or 3.2.0.0.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is GHSA-22vx-2x23-98w6 being exploited?
There is no known exploitation of GHSA-22vx-2x23-98w6 in the wild and no public exploit code.