OpenSearch: Authenticated Denial of Service

A vulnerability has been identified in OpenSearch that can be exploited by a remote, authenticated attacker to cause a Denial of Service (DoS). The source indicates that successful exploitation results in service disruption. No CVE identifier or technical details regarding the specific attack vector have been disclosed by the vendor at this time.

Recommendation

• Inventory all internal and internet-facing OpenSearch deployments.
• Review the official OpenSearch project security notifications for patches addressing Denial of Service vulnerabilities.
• Monitor OpenSearch cluster logs and performance metrics for sudden spikes in resource consumption or unexpected service restarts.
• Audit existing authentication and authorization policies to minimize the number of users with privileges required to trigger intensive system processes.