Log in Start free

Vulnerability · Published Oct 15, 2025 · Assigned by GitHub_M

CVE-2025-62371OpenSearch Data Prepper plugins trusts all SSL certificates by default

High 7.4

In plain English

A high-severity improper certificate validation in data-prepper from opensearch-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.2%top 90.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

OpenSearch Data Prepper as an open source data collector for observability data. In versions prior to 2.12.2, the OpenSearch sink and source plugins in Data Prepper trust all SSL certificates by default when no certificate path is provided. Prior to this fix, the OpenSearch sink and source plugins would automatically use a trust all SSL strategy when connecting to OpenSearch clusters if no certificate path was explicitly configured. This behavior bypasses SSL certificate validation, potentially allowing attackers to intercept and modify data in transit through man-in-the-middle attacks. The vulnerability affects connections to OpenSearch when the cert parameter is not explicitly provided. This issue has been patched in version 2.12.2. As a workaround, users can add the cert parameter to their OpenSearch sink or source configuration with the path to the cluster's CA certificate.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.opensearch.dataprepper.plugins:opensearch2.12.2GHSA-43ff-rr26-8hx4

Affected products (as reported)

VendorProductVersions
opensearch-project data-prepper < 2.12.2

Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References