diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2b30aa93b8e0a..b8562faa8515c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -53,6 +53,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 - Bump `reactor-netty` from 1.1.15 to 1.1.17 ([#12633](https://github.com/opensearch-project/OpenSearch/pull/12633))
 - Bump `reactor` from 3.5.14 to 3.5.15 ([#12633](https://github.com/opensearch-project/OpenSearch/pull/12633))
 - Bump `aws-sdk-java` from 2.20.55 to 2.20.86 ([#12251](https://github.com/opensearch-project/OpenSearch/pull/12251))
+- Bump `org.apache.commons:commons-configuration2` from 2.9.0 to 2.10.0 ([#12721](https://github.com/opensearch-project/OpenSearch/pull/12721))
 
 ### Changed
 - Allow composite aggregation to run under a parent filter aggregation ([#11499](https://github.com/opensearch-project/OpenSearch/pull/11499))
diff --git a/plugins/repository-hdfs/build.gradle b/plugins/repository-hdfs/build.gradle
index d7a421c285800..eec14373b87aa 100644
--- a/plugins/repository-hdfs/build.gradle
+++ b/plugins/repository-hdfs/build.gradle
@@ -74,7 +74,7 @@ dependencies {
   api "commons-codec:commons-codec:${versions.commonscodec}"
   api 'commons-collections:commons-collections:3.2.2'
   api "org.apache.commons:commons-compress:${versions.commonscompress}"
-  api 'org.apache.commons:commons-configuration2:2.8.0'
+  api 'org.apache.commons:commons-configuration2:2.10.0'
   api 'commons-io:commons-io:2.15.1'
   api 'org.apache.commons:commons-lang3:3.14.0'
   implementation 'com.google.re2j:re2j:1.6'
diff --git a/plugins/repository-hdfs/licenses/commons-configuration2-2.10.0.jar.sha1 b/plugins/repository-hdfs/licenses/commons-configuration2-2.10.0.jar.sha1
new file mode 100644
index 0000000000000..17d1b64781e5b
--- /dev/null
+++ b/plugins/repository-hdfs/licenses/commons-configuration2-2.10.0.jar.sha1
@@ -0,0 +1 @@
+2b93eff3c83e5372262ed4996b609336305a810f
\ No newline at end of file
diff --git a/plugins/repository-hdfs/licenses/commons-configuration2-2.8.0.jar.sha1 b/plugins/repository-hdfs/licenses/commons-configuration2-2.8.0.jar.sha1
deleted file mode 100644
index 0f782489a571d..0000000000000
--- a/plugins/repository-hdfs/licenses/commons-configuration2-2.8.0.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-6a76acbe14d2c01d4758a57171f3f6a150dbd462
\ No newline at end of file