CVE-2025-62371OpenSearch Data Prepper plugins trusts all SSL certificates by default
Updated under an hour ago ()
Does this affect you?
It affects opensearch-project data-prepper and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
OpenSearch Data Prepper as an open source data collector for observability data. In versions prior to 2.12.2, the OpenSearch sink and source plugins in Data Prepper trust all SSL certificates by default when no certificate path is provided. Prior to this fix, the OpenSearch sink and source plugins would automatically use a trust all SSL strategy when connecting to OpenSearch clusters if no certificate path was explicitly configured. This behavior bypasses SSL certificate validation, potentially allowing attackers to intercept and modify data in transit through man-in-the-middle attacks. The vulnerability affects connections to OpenSearch when the cert parameter is not explicitly provided. This issue has been patched in version 2.12.2. As a workaround, users can add the cert parameter to their OpenSearch sink or source configuration with the path to the cluster's CA certificate.
- CVSS
- 7.4 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weakness (CWE)
- CWE-295
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Analyzed
- Record last updated
- Oct 15, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
opensearch-project data-prepper opensearch_project:data_prepper (from the name) | before 2.12.2 | CNA record |
amazon opensearch_data_prepper amazon:opensearch_data_prepper | before 2.12.2 | NVD |
References
- https://github.com/opensearch-project/data-prepper/security/advisories/GHSA-43ff-rr26-8hx4x-refsource-confirm, vendor-advisory
- https://github.com/opensearch-project/data-prepper/commit/98fcf0d0ff9c18f1f7501e11dbed918814724b99x-refsource-misc, patch
- https://github.com/opensearch-project/data-prepper/commit/b0386a5af3fb71094ba6c86cd8b2afc783246599x-refsource-misc, patch
- https://github.com/opensearch-project/data-prepper/commit/db11ce8f27ebca018980b2bca863f7173de9ce56x-refsource-misc, patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.