CVE-2026-18420highCWE-1321

CVE-2026-18420: falha de alta gravidade em OpenSearch Dashboards

RCE via Prototype Pollution in OpenSearch Dashboards

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Amazon OpenSearch Service+ Monitorar OpenSearch Dashboards

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 1.0%
Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enables remote code execution.  To remediate this issue, users should upgrade to OpenSearch Dashboards 3.8 or later.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
AWS · Amazon OpenSearch ServiceOpenSearch · OpenSearch Dashboards
CVEs relacionadas — OpenSearch Dashboards

No mesmo produto, das mais perigosas para as menos.

CVE-2026-75897HIGHUncontrolled Resource Consumption in Capabilities Route in OpenSearch DashboardsEPSS 0.7%CVE-2026-84942MEDIUMStored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch DashboardsEPSS 0.5%CVE-2026-77811MEDIUMStored Cross-Site Scripting via Integration Template Asset in OpenSearch DashboardsEPSS 0.5%