Cloudanix VulnDB

GHSA-22vx-2x23-98w6

Low · 2.2

OpenSearch vulnerable to improper authorization for Rollover Requests

CVSS

2.2

EPSS

—

Published

May 7, 2026

CISA due date

—

The record

A flaw was identified in the OpenSearch Security plugin's handling of index rollover requests. When a rollover request included an explicit target index name, the security plugin did not properly evaluate access control permissions against the target index. This could allow a user with rollover permissions on a source index to create a new index with a name they are not authorized to use.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities