Skip to content
OpenAdvisories

Product · AWS

Amazon OpenSearch Service

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.7
    CVE-2026-84942

    Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards

    Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a …

    AWS OpenSearch OpenSearch-Dashboards Amazon OpenSearch Service
  • High 8.7
    CVE-2026-77811

    Stored Cross-Site Scripting via Integration Template Asset in OpenSearch Dashboards

    Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenticated user with write permissions to OpenSearch Dashboards saved objects to execute arbitrary JavaScript in the context of other users' browser s…

    AWS OpenSearch Amazon OpenSearch Service OpenSearch Dashboards dashboards-observability plugin
  • High 8.8
    CVE-2026-18420

    RCE via Prototype Pollution in OpenSearch Dashboards

    Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is …

    AWS OpenSearch OpenSearch-Dashboards Amazon OpenSearch Service
  • High 7.5
    CVE-2026-75897

    Uncontrolled Resource Consumption in Capabilities Route in OpenSearch Dashboards

    Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - might allow remote attackers to cause a denial of service via a crafted HTTP request.

    AWS OpenSearch Amazon OpenSearch Service OpenSearch-Dashboards