CVE-2025-62371

OpenSearch Data Prepper as an open source data collector for observability data. In versions prior to 2.12.2, the OpenSearch sink and source plugins in Data Prepper trust all SSL certificates by default when no certificate path is provided. Prior to this fix, the OpenSearch sink and source plugins would automatically use a trust all SSL strategy when connecting to OpenSearch clusters if no certificate path was explicitly configured. This behavior bypasses SSL certificate validation, potentially allowing attackers to intercept and modify data in transit through man-in-the-middle attacks. The vulnerability affects connections to OpenSearch when the cert parameter is not explicitly provided. This issue has been patched in version 2.12.2. As a workaround, users can add the cert parameter to their OpenSearch sink or source configuration with the path to the cluster's CA certificate.

• CWE-295

• https://github.com/opensearch-project/data-prepper/commit/98fcf0d0ff9c18f1f7501e11dbed918814724b99Patch
• https://github.com/opensearch-project/data-prepper/commit/b0386a5af3fb71094ba6c86cd8b2afc783246599Patch
• https://github.com/opensearch-project/data-prepper/commit/db11ce8f27ebca018980b2bca863f7173de9ce56Patch
• https://github.com/opensearch-project/data-prepper/security/advisories/GHSA-43ff-rr26-8hx4Vendor Advisory

Published

Oct 15, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-62366mailgen is a Node.js package that generates responsive HTML …2.9
• CVE-2025-62367Taiga is an open source project management platform. In vers…4.8
• CVE-2025-62368Taiga is an open source project management platform. In vers…9
• CVE-2025-62369Xibo is an open source digital signage platform with a web c…7.2
• CVE-2025-6237A vulnerability in invokeai version v6.0.0a1 and below allow…9.8
• CVE-2025-62370Alloy Core libraries at the root of the Rust Ethereum ecosys…7.5
• CVE-2025-62372vLLM is an inference and serving engine for large language m…6.5
• CVE-2025-62373Pipecat is an open-source Python framework for building real…9.8
• CVE-2025-62374Parse Javascript SDK provides access to the powerful Parse S…6.4
• CVE-2025-62375go-witness and witness are Go modules for generating attesta…6.9
• CVE-2025-62376pwn.college DOJO is an education platform for learning cyber…9.5
• CVE-2025-62378CommandKit is the discord.js meta-framework for building Dis…6.1