8.7
High
CVE-2026-77811 Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote…
Description
Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenticated user with write permissions to OpenSearch Dashboards saved objects to execute arbitrary JavaScript in the context of other users' browser sessions by uploading a saved asset with arbitrary web content.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Amazon OpenSearch Service | Versions not published | |
| OpenSearch Dashboards dashboards-observability plugin 3.4 | earliest → < 3.4 | 3.4 |
| OpenSearch Dashboards dashboards-observability plugin 2.19 | earliest → < 2.19.6 | 2.19.6 |
References
- opensearch.org opensearch.org
- opensearch.org opensearch.org
- aws.amazon.com aws.amazon.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of Amazon OpenSearch Service
The 4 CVEs of Amazon OpenSearch Service →
CVE-2026-84942
Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote…
8.7
High
CVE-2026-18420
Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an…
8.8
High
CVE-2026-75897
Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload…
7.5
High