CVE-2023-23612: OpenSearch Security JWT Roles Whitespace Issue
Summary
CVE-2023-23612: Issue with whitespace in JWT roles in OpenSearch. Affects org.opensearch.plugin:opensearch-security across 2 version ranges.
< 1.3.8
>= 2.0.0, < 2.5.0
Fixed in 1.3.8 or 2.5.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSearch is an open-source search and analytics engine based on Elasticsearch. It provides powerful search capabilities and is widely used for various applications. The OpenSearch Security plugin is responsible for handling authentication and access control in OpenSearch. It supports JWTs (JSON Web Tokens) for storing role claims obtained from the Identity Provider (IdP) when using SAML or OpenID Connect for authentication.
Vulnerability Detail
The OpenSearch Security plugin has a vulnerability related to whitespace in JWT roles. When processing role claims from JWTs, leading and trailing whitespace is trimmed. This allows authenticated users to potentially claim roles they are not assigned to if any role matches the whitespace-stripped version of the roles they are a member of. However, this vulnerability requires the existence of roles that match, not considering leading/trailing whitespace, or the ability for users to create such matching roles. Additionally, the Identity Provider must allow leading and trailing spaces in role names. The impact of this vulnerability is moderate.
How To Fix
Latest published version: 3.9.0.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.3.81.3.8 -
>= 2.0.0, < 2.5.02.5.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability.
Conclusion
The OpenSearch Security JWT Roles Whitespace Issue allows authenticated users to potentially claim roles they are not assigned to. It is recommended to upgrade to the patched versions of OpenSearch to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.opensearch.plugin:opensearch-security →
FAQ
OpenSearch versions 1.0.0-1.3.7 and 2.0.0-2.4.1 are affected.
Authenticated users can potentially claim roles they are not assigned to if any role matches the whitespace-stripped version of the roles they are a member of.
The vulnerability requires the existence of roles that match, not considering leading/trailing whitespace, or the ability for users to create such matching roles. Additionally, the Identity Provider must allow leading and trailing spaces in role names.
No, this vulnerability is only present for authenticated users.
Yes, the advisory is available on the GitHub Advisory Database.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.opensearch.plugin:opensearch-security.
