8.8
Élevée
CVE-2026-18420 Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an…
Description
Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enables remote code execution. To remediate this issue, users should upgrade to OpenSearch Dashboards 3.8 or later.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Amazon OpenSearch Service 3.0 | 3.0.0 → < 3.8.0 | 3.8.0 |
| OpenSearch Dashboards 3.0 | 3.0.0 → < 3.8.0 | 3.8.0 |
Références
- github.com github.com
- github.com github.com
- aws.amazon.com aws.amazon.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Amazon OpenSearch Service
Les 4 CVE de Amazon OpenSearch Service →
CVE-2026-84942
Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote…
8.7
Élevée
CVE-2026-77811
Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote…
8.7
Élevée
CVE-2026-75897
Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload…
7.5
Élevée