CVE-2023-23613

OpenSearch is an open source distributed and RESTful search engine. In affected versions there is an issue in the implementation of field-level security (FLS) and field masking where rules written to explicitly exclude fields are not correctly applied for certain queries that rely on their auto-generated .keyword fields. This issue is only present for authenticated users with read access to the indexes containing the restricted fields. This may expose data which may otherwise not be accessible to the user. OpenSearch 1.0.0-1.3.7 and 2.0.0-2.4.1 are affected. Users are advised to upgrade to OpenSearch 1.3.8 or 2.5.0. Users unable to upgrade may write explicit exclusion rules as a workaround. Policies authored in this way are not subject to this issue.

• CWE-200
• CWE-200

• https://github.com/opensearch-project/OpenSearch/releases/tag/2.5.0Third Party Advisory
• https://github.com/opensearch-project/security/security/advisories/GHSA-v3cg-7r9h-r2g6Third Party Advisory
• https://github.com/opensearch-project/OpenSearch/releases/tag/2.5.0Third Party Advisory
• https://github.com/opensearch-project/security/security/advisories/GHSA-v3cg-7r9h-r2g6Third Party Advisory

Published

Jan 26, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-23608Spotipy is a light weight Python library for the Spotify Web…4.3
• CVE-2023-23609Contiki-NG is an open-source, cross-platform operating syste…7.4
• CVE-2023-2361Cross-site Scripting (XSS) - Stored in GitHub repository pim…5.4
• CVE-2023-23610GLPI is a Free Asset and IT Management Software package. Ver…6.5
• CVE-2023-23611LTI Consumer XBlock implements the consumer side of the LTI …5.4
• CVE-2023-23612OpenSearch is an open source distributed and RESTful search …8.8
• CVE-2023-23614Pi-hole®'s Web interface (based off of AdminLTE) provides a …8.8
• CVE-2023-23615Discourse is an open source discussion platform. The embedda…5.3
• CVE-2023-23616Discourse is an open-source discussion platform. Prior to ve…4.3
• CVE-2023-23617OpenMage LTS is an e-commerce platform. Versions prior to 19…7.5
• CVE-2023-23618Git for Windows is the Windows port of the revision control …7.8
• CVE-2023-23619Modelina is a library for generating data models based on in…8.8