{"id":"GHSA-x5hg-x4gv-j98m","aliases":[],"url":"https://o3.security/vulnerability/GHSA-x5hg-x4gv-j98m","summary":"OpenSearch has ineffective TLS certificate hostname verification","details":"### Description\n\nA regression was introduced in OpenSearch 2.18.0 that caused the `plugins.security.ssl.transport.enforce_hostname_verification` setting to be ineffective. When this setting was enabled, OpenSearch did not verify that the hostname in a connecting node's TLS certificate matched the hostname of the connection. This could allow a node with a valid certificate (signed by the cluster's trusted CA) but an incorrect hostname SAN to join the cluster.\n\n### Impact\n\nClusters running affected versions with hostname verification enabled did not receive the expected protection from this setting. A node presenting a certificate signed by the cluster's trusted CA could join the cluster regardless of whether its hostname SAN matched. This regression does not affect certificate validation itself — only the additional hostname verification check.\n\n### Patches\n\nThis issue is fixed in OpenSearch 2.19.4 and 3.3.0.\n\n### Workarounds\n\nUse more restrictive values for `plugins.security.nodes_dn` to limit which certificates are accepted for node-to-node communication.","published":"2026-05-07T00:09:18Z","modified":"2026-05-07T00:21:11.903034Z","cvss":{"score":2.2,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.opensearch.plugin:opensearch-security","fixedVersion":"2.19.4.0"},{"ecosystem":"Maven","name":"org.opensearch.plugin:opensearch-security","fixedVersion":"3.3.0.0"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/opensearch-project/security/security/advisories/GHSA-x5hg-x4gv-j98m"},{"type":"PACKAGE","url":"https://github.com/opensearch-project/security"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-05-07T00:21:11.903034Z"}}