A vulnerability in the OpenSearch REST layer allows bypassing authorization checks via malformed HTTP requests, potentially granting unauthorized read access to certain API endpoints. The default OpenSearch distribution is not affected due to transport-level authorization enforcement. Custom plugins that register REST actions without corresponding transport actions may be vulnerable. The issue is fixed in OpenSearch version 2.19.0.