Skip to content
Sign in
8.8 High

CVE-2026-18420 Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an…

Description

Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enables remote code execution.  To remediate this issue, users should upgrade to OpenSearch Dashboards 3.8 or later.

Affected products and versions

Product Affected versions Fixed in
Amazon OpenSearch Service 3.0 3.0.0 → < 3.8.0 3.8.0
OpenSearch Dashboards 3.0 3.0.0 → < 3.8.0 3.8.0

Other CVEs of Amazon OpenSearch Service

The 4 CVEs of Amazon OpenSearch Service →
CVE-2026-84942 Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote… 8.7 High CVE-2026-77811 Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote… 8.7 High CVE-2026-75897 Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload… 7.5 High
Track this CVE