CVE-2024-39901

Maven/org.opensearch.plugin:opensearch-observability CVE-2024-39901: medium 4.2, EPSS 0.29%

OpenSearch Observability does not properly restrict access to private tenant resources

Action: Upgrade org.opensearch.plugin:opensearch-observability to 2.14.0.0 or later.

Affected

Fixed versions

Sources

• osv: GHSA-77vc-rj32-2r33
• https://github.com/opensearch-project/observability/security/advisories/GHSA-77vc-rj32-2r33
• https://nvd.nist.gov/vuln/detail/CVE-2024-39901
• https://github.com/opensearch-project/observability/commit/014423178f8f61d90442dde03cbdcd754c70a84e
• https://github.com/opensearch-project/observability
• https://opensearch.org/versions/opensearch-2-14-0.html

CVE-2024-39901 · published 2024-07-10T16:04:08Z · modified 2026-09-10T03:50:16.429804763Z · JSON