CVE-2023-31141 json
OpenSearch issue with fine-grained access control during extremely rare race conditions
published 2023-05-08 3 y ago modified 2026-06-17 4 mo ago also GHSA-g8xc-6mf7-h28h , EUVD-2023-1541
- cvss
- 4.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 40%
- public exploits
- 0
- none known
Summary
OpenSearch is open-source software suite for search, analytics, and observability applications. Prior to versions 1.3.10 and 2.7.0, there is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the queries during extremely rare race conditions potentially leading to incorrect access authorization. For this issue to be triggered, two concurrent requests need to land on the same instance exactly when query cache eviction happens, once every four hours. OpenSearch 1.3.10 and 2.7.0 contain a fix for this issue.
Patch / fix
- maven org.opensearch.plugin:opensearch-security 1.3.10.0, 2.7.0.0
- amazon opensearch 1.3.10, 2.7.0
- amazon opensearch_security 1.3.10, 2.7.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
0.46% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.8 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 4.8 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.opensearch.plugin:opensearch-security | >=1.0.0, <1.3.10.0 >=2.0.0, <2.7.0.0 |
1.3.10.0 2.7.0.0 |
Affected products
- opensearch-project security
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
github.com
/opensearch-project/security/security/advisories/GHSA-g8xc-6mf7-h28h
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-31141
advisory
-
github.com
/opensearch-project/security
package
Sources
- CVE List CVE-2023-31141
- GitHub Advisory GHSA-g8xc-6mf7-h28h
- NVD CVE-2023-31141
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.