-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.opensearch.plugin:opensearch-security | maven | < 1.3.7 | 1.3.7 |
| org.opensearch.plugin:opensearch-security | maven | >= 2.0.0, < 2.4.0 | 2.4.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper index resolution logic for data streams. The commit diff shows the key fix was adding DATA_STREAM type handling in ConfigModelV7.java's index resolution process(). The vulnerable version: 1. Only filtered for ALIAS types when resolving indices 2. Didn't pass includeDataStreams=true parameter to concreteIndexNames resolver 3. This caused security rules to be applied to aliases but not data stream backing indices. The tests added in DataStreamIntegrationTests.java demonstrate scenarios where DLS/FLS/field masking were previously failing on data stream indices, confirming the security control bypass.