{"id":"GHSA-x5hg-x4gv-j98m","summary":"OpenSearch has ineffective TLS certificate hostname verification","details":"### Description\n\nA regression was introduced in OpenSearch 2.18.0 that caused the `plugins.security.ssl.transport.enforce_hostname_verification` setting to be ineffective. When this setting was enabled, OpenSearch did not verify that the hostname in a connecting node's TLS certificate matched the hostname of the connection. This could allow a node with a valid certificate (signed by the cluster's trusted CA) but an incorrect hostname SAN to join the cluster.\n\n### Impact\n\nClusters running affected versions with hostname verification enabled did not receive the expected protection from this setting. A node presenting a certificate signed by the cluster's trusted CA could join the cluster regardless of whether its hostname SAN matched. This regression does not affect certificate validation itself — only the additional hostname verification check.\n\n### Patches\n\nThis issue is fixed in OpenSearch 2.19.4 and 3.3.0.\n\n### Workarounds\n\nUse more restrictive values for `plugins.security.nodes_dn` to limit which certificates are accepted for node-to-node communication.","modified":"2026-05-07T00:21:11.903034Z","published":"2026-05-07T00:09:18Z","database_specific":{"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2026-05-07T00:09:18Z","nvd_published_at":null,"cwe_ids":["CWE-295"]},"references":[{"type":"WEB","url":"https://github.com/opensearch-project/security/security/advisories/GHSA-x5hg-x4gv-j98m"},{"type":"PACKAGE","url":"https://github.com/opensearch-project/security"}],"affected":[{"package":{"name":"org.opensearch.plugin:opensearch-security","ecosystem":"Maven","purl":"pkg:maven/org.opensearch.plugin/opensearch-security"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.0"},{"fixed":"2.19.4.0"}]}],"versions":["2.18.0.0","2.19.0.0","2.19.1.0","2.19.2.0","2.19.3.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-x5hg-x4gv-j98m/GHSA-x5hg-x4gv-j98m.json"}},{"package":{"name":"org.opensearch.plugin:opensearch-security","ecosystem":"Maven","purl":"pkg:maven/org.opensearch.plugin/opensearch-security"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.3.0.0"}]}],"versions":["3.0.0.0","3.1.0.0","3.2.0.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-x5hg-x4gv-j98m/GHSA-x5hg-x4gv-j98m.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N"}]}