CVE-2026-18420
RCE via Prototype Pollution in OpenSearch Dashboards
- State
- Published
- Severity
- 8.7 High
- Published
- Aug 20, 2026
- Updated
- Aug 25, 2026
- Reserved
- Jul 30, 2026
Description
Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enables remote code execution.
To remediate this issue, users should upgrade to OpenSearch Dashboards 3.8 or later.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | AMZN |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | AMZN |
Weaknesses
- CWE-1321 Improperly controlled modification of object prototype attributes ('prototype pollution')
Affected Products
| Product | Versions |
|---|---|
Amazon OpenSearch ServiceAWS |
|
OpenSearch DashboardsOpenSearch |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.