Search

Find a vulnerability

Search criteria Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    4 vulnerabilities found for Opensearch by Github

    CVE-2026-19311 (GCVE-0-2026-19311)

    Vulnerability from nvd – Published: 2026-08-12 18:34 – Updated: 2026-08-13 14:53
    VLAI
    Title
    Missing Authorization in Execute Monitor API in OpenSearch Alerting Plugin
    Summary
    Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-13 14:52 UTC
    CWE
    • CWE-475 - Undefined behavior for input to API
    Assigner
    Impacted products
    Vendor Product Version
    AWS OpenSearch Affected: 2.4 , ≤ 3.5 (custom)
    Create a notification for this product.
    Github OpenSearch Affected: 2.4.0 , ≤ 2.19.5 (custom)
    Affected: 3.0.0 , ≤ 3.7.0 (custom)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-19311",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-13T14:52:46.699820Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-13T14:53:00.212Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "OpenSearch",
              "vendor": "AWS",
              "versions": [
                {
                  "lessThanOrEqual": "3.5",
                  "status": "affected",
                  "version": "2.4",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "OpenSearch",
              "vendor": "Github",
              "versions": [
                {
                  "lessThanOrEqual": "2.19.5",
                  "status": "affected",
                  "version": "2.4.0",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "3.7.0",
                  "status": "affected",
                  "version": "3.0.0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:aws:opensearch:*:*:*:*:*:*:*:*",
                      "versionEndIncluding": "3.5",
                      "versionStartIncluding": "2.4",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                },
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:github:opensearch:*:*:*:*:*:*:*:*",
                      "versionEndIncluding": "2.19.5",
                      "versionStartIncluding": "2.4.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:github:opensearch:*:*:*:*:*:*:*:*",
                      "versionEndIncluding": "3.7.0",
                      "versionStartIncluding": "3.0.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ],
              "operator": "OR"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eMissing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters.\u003c/p\u003e"
                }
              ],
              "value": "Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-1",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.6,
                "baseSeverity": "HIGH",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            },
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-475",
                  "description": "CWE-475 Undefined behavior for input to API",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-12T18:34:02.669Z",
            "orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
            "shortName": "AMZN"
          },
          "references": [
            {
              "tags": [
                "release-notes"
              ],
              "url": "https://aws.amazon.com/about-aws/whats-new/2026/03/amazon-opensearch-service-version-3-5/"
            },
            {
              "tags": [
                "release-notes",
                "patch"
              ],
              "url": "https://github.com/opensearch-project/alerting/security/advisories/GHSA-xxpg-q3wh-685q"
            },
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://aws.amazon.com/security/security-bulletins/2026-078-aws/"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Missing Authorization in Execute Monitor API in OpenSearch Alerting Plugin",
          "x_generator": {
            "engine": "Vulnogram 1.0.4"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
        "assignerShortName": "AMZN",
        "cveId": "CVE-2026-19311",
        "datePublished": "2026-08-12T18:34:02.669Z",
        "dateReserved": "2026-08-07T17:50:37.734Z",
        "dateUpdated": "2026-08-13T14:53:00.212Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-18952 (GCVE-0-2026-18952)

    Vulnerability from nvd – Published: 2026-08-12 18:42 – Updated: 2026-08-13 14:51
    VLAI
    Title
    Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics Plugin
    Summary
    Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-13 14:51 UTC
    CWE
    • CWE-918 - Server-Side request forgery (SSRF)
    Assigner
    References
    Impacted products
    Vendor Product Version
    AWS Opensearch Affected: 2.15.0 , < 3.5.0 (custom)
    Create a notification for this product.
    Github Opensearch Affected: 2.15.0 , < 3.5.0 (custom)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-18952",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-13T14:51:22.324872Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-13T14:51:33.805Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Opensearch",
              "vendor": "AWS",
              "versions": [
                {
                  "lessThan": "3.5.0",
                  "status": "affected",
                  "version": "2.15.0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Opensearch",
              "vendor": "Github",
              "versions": [
                {
                  "lessThan": "3.5.0",
                  "status": "affected",
                  "version": "2.15.0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:aws:opensearch:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "3.5.0",
                      "versionStartIncluding": "2.15.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                },
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:github:opensearch:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "3.5.0",
                      "versionStartIncluding": "2.15.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ],
              "operator": "OR"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eMissing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint.\u003c/p\u003e"
                }
              ],
              "value": "Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-664",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-664 Server Side Request Forgery"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.6,
                "baseSeverity": "HIGH",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            },
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-918",
                  "description": "CWE-918 Server-Side request forgery (SSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-12T18:42:38.633Z",
            "orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
            "shortName": "AMZN"
          },
          "references": [
            {
              "tags": [
                "patch"
              ],
              "url": "https://docs.aws.amazon.com/opensearch-service/latest/developerguide/service-software.html"
            },
            {
              "tags": [
                "vendor-advisory",
                "release-notes"
              ],
              "url": "https://aws.amazon.com/security/security-bulletins/2026-079-aws/"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics Plugin",
          "x_generator": {
            "engine": "Vulnogram 1.0.4"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
        "assignerShortName": "AMZN",
        "cveId": "CVE-2026-18952",
        "datePublished": "2026-08-12T18:42:38.633Z",
        "dateReserved": "2026-08-05T13:44:23.785Z",
        "dateUpdated": "2026-08-13T14:51:33.805Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-18952 (GCVE-0-2026-18952)

    Vulnerability from cvelistv5 – Published: 2026-08-12 18:42 – Updated: 2026-08-13 14:51
    VLAI
    Title
    Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics Plugin
    Summary
    Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-13 14:51 UTC
    CWE
    • CWE-918 - Server-Side request forgery (SSRF)
    Assigner
    References
    Impacted products
    Vendor Product Version
    AWS Opensearch Affected: 2.15.0 , < 3.5.0 (custom)
    Create a notification for this product.
    Github Opensearch Affected: 2.15.0 , < 3.5.0 (custom)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-18952",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-13T14:51:22.324872Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-13T14:51:33.805Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Opensearch",
              "vendor": "AWS",
              "versions": [
                {
                  "lessThan": "3.5.0",
                  "status": "affected",
                  "version": "2.15.0",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "Opensearch",
              "vendor": "Github",
              "versions": [
                {
                  "lessThan": "3.5.0",
                  "status": "affected",
                  "version": "2.15.0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:aws:opensearch:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "3.5.0",
                      "versionStartIncluding": "2.15.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                },
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:github:opensearch:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "3.5.0",
                      "versionStartIncluding": "2.15.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ],
              "operator": "OR"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eMissing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint.\u003c/p\u003e"
                }
              ],
              "value": "Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-664",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-664 Server Side Request Forgery"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.6,
                "baseSeverity": "HIGH",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            },
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-918",
                  "description": "CWE-918 Server-Side request forgery (SSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-12T18:42:38.633Z",
            "orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
            "shortName": "AMZN"
          },
          "references": [
            {
              "tags": [
                "patch"
              ],
              "url": "https://docs.aws.amazon.com/opensearch-service/latest/developerguide/service-software.html"
            },
            {
              "tags": [
                "vendor-advisory",
                "release-notes"
              ],
              "url": "https://aws.amazon.com/security/security-bulletins/2026-079-aws/"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics Plugin",
          "x_generator": {
            "engine": "Vulnogram 1.0.4"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
        "assignerShortName": "AMZN",
        "cveId": "CVE-2026-18952",
        "datePublished": "2026-08-12T18:42:38.633Z",
        "dateReserved": "2026-08-05T13:44:23.785Z",
        "dateUpdated": "2026-08-13T14:51:33.805Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-19311 (GCVE-0-2026-19311)

    Vulnerability from cvelistv5 – Published: 2026-08-12 18:34 – Updated: 2026-08-13 14:53
    VLAI
    Title
    Missing Authorization in Execute Monitor API in OpenSearch Alerting Plugin
    Summary
    Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-08-13 14:52 UTC
    CWE
    • CWE-475 - Undefined behavior for input to API
    Assigner
    Impacted products
    Vendor Product Version
    AWS OpenSearch Affected: 2.4 , ≤ 3.5 (custom)
    Create a notification for this product.
    Github OpenSearch Affected: 2.4.0 , ≤ 2.19.5 (custom)
    Affected: 3.0.0 , ≤ 3.7.0 (custom)
    Create a notification for this product.
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-19311",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-13T14:52:46.699820Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-13T14:53:00.212Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "OpenSearch",
              "vendor": "AWS",
              "versions": [
                {
                  "lessThanOrEqual": "3.5",
                  "status": "affected",
                  "version": "2.4",
                  "versionType": "custom"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "OpenSearch",
              "vendor": "Github",
              "versions": [
                {
                  "lessThanOrEqual": "2.19.5",
                  "status": "affected",
                  "version": "2.4.0",
                  "versionType": "custom"
                },
                {
                  "lessThanOrEqual": "3.7.0",
                  "status": "affected",
                  "version": "3.0.0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:aws:opensearch:*:*:*:*:*:*:*:*",
                      "versionEndIncluding": "3.5",
                      "versionStartIncluding": "2.4",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                },
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:github:opensearch:*:*:*:*:*:*:*:*",
                      "versionEndIncluding": "2.19.5",
                      "versionStartIncluding": "2.4.0",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:a:github:opensearch:*:*:*:*:*:*:*:*",
                      "versionEndIncluding": "3.7.0",
                      "versionStartIncluding": "3.0.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ],
              "operator": "OR"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eMissing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters.\u003c/p\u003e"
                }
              ],
              "value": "Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-1",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.6,
                "baseSeverity": "HIGH",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            },
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-475",
                  "description": "CWE-475 Undefined behavior for input to API",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-12T18:34:02.669Z",
            "orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
            "shortName": "AMZN"
          },
          "references": [
            {
              "tags": [
                "release-notes"
              ],
              "url": "https://aws.amazon.com/about-aws/whats-new/2026/03/amazon-opensearch-service-version-3-5/"
            },
            {
              "tags": [
                "release-notes",
                "patch"
              ],
              "url": "https://github.com/opensearch-project/alerting/security/advisories/GHSA-xxpg-q3wh-685q"
            },
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://aws.amazon.com/security/security-bulletins/2026-078-aws/"
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "Missing Authorization in Execute Monitor API in OpenSearch Alerting Plugin",
          "x_generator": {
            "engine": "Vulnogram 1.0.4"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
        "assignerShortName": "AMZN",
        "cveId": "CVE-2026-19311",
        "datePublished": "2026-08-12T18:34:02.669Z",
        "dateReserved": "2026-08-07T17:50:37.734Z",
        "dateUpdated": "2026-08-13T14:53:00.212Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }