Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.2
OpenSearch allows unauthorized index creation via Rollover API
published 6 months ago
Summary
A security issue in OpenSearch allows users with certain permissions to create new indexes outside their authorized range. This is limited to the Rollover API and requires users to already have the necessary permissions. To fix this, update to OpenSearch 2.19.4 or 3.2.0, or restrict the 'indices:admin/rollover' permission to trusted users.
What to do
- Update opensearch org.opensearch.plugin:opensearch-security to version 2.19.4.0.
- Update opensearch org.opensearch.plugin:opensearch-security to version 3.2.0.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Maven | opensearch | org.opensearch.plugin:opensearch-security |
>= 1.0.0, < 2.19.4.0 >= 3.0.0, < 3.2.0.0 Fix: upgrade to 2.19.4.0
|
Original advisory text
OpenSearch vulnerable to improper authorization for Rollover Requests
### Description
A flaw was identified in the OpenSearch Security plugin's handling of index rollover requests. When a rollover request included an explicit target index name, the security plugin did not properly evaluate access control permissions against the target index. This could allow a user with rollover permissions on a source index to create a new index with a name they are not authorized to use.
### Impact
A user with `indices:admin/rollover` permission on a source index pattern could roll over to a target index name outside their authorized index patterns. This is limited to index creation via the rollover API and requires the user to already have rollover privileges on the source index.
### Patches
This issue is fixed in OpenSearch 2.19.4 and 3.2.0
### Workarounds
Grant the `indices:admin/rollover` permission only to fully trusted users.
A flaw was identified in the OpenSearch Security plugin's handling of index rollover requests. When a rollover request included an explicit target index name, the security plugin did not properly evaluate access control permissions against the target index. This could allow a user with rollover permissions on a source index to create a new index with a name they are not authorized to use.
### Impact
A user with `indices:admin/rollover` permission on a source index pattern could roll over to a target index name outside their authorized index patterns. This is limited to index creation via the rollover API and requires the user to already have rollover privileges on the source index.
### Patches
This issue is fixed in OpenSearch 2.19.4 and 3.2.0
### Workarounds
Grant the `indices:admin/rollover` permission only to fully trusted users.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-863Incorrect Authorization
Timeline
Published7 May 2026
Updated7 May 2026
First seen7 May 2026
Sources
GHSA-22vx-2x23-98w6 · OSV
Track software like this
Free during beta