CVE-2026-19311- Missing Authorization in OpenSearch Alerting Plugin
Cybersecurity Classified by Officially
CVE-2026-19311- Missing Authorization in OpenSearch Alerting Plugin
Bulletin ID: 2026-078-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 08/12/2026 11:30 AM PDT
OpenSearch is a community-driven, open-source search and analytics suite. We identified CVE-2026-19311, a missing authorization issue in the Execute Monitor API of the OpenSearch Alerting plugin. This issue may allow an authenticated user with the alerting_full_access role to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters.
OpenSearch Alerting Plugin (open-source, self-managed):
Amazon OpenSearch Service (AWS Managed):
Upgrade to OpenSearch 2.19.6 or 3.8.0 or later. The update addresses an input validation issue in the Execute Monitor API. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
We recommend that customers update their domains to the latest service software version as soon as possible. No engine version upgrade is required. You can apply the update from the console by selecting your domain, choosing Actions, Service Software Version, then clicking Update. Domains with automatic software updates enabled receive this update during their next off-peak window with no action required. For full details, see Service software updates in Amazon OpenSearch Service.
If immediate upgrade is not possible, restrict the alerting_full_access role to only trusted administrative users to minimize visibility to this issue.
This is an extract. The publication continues at the source.
Read the original at the source: https://aws.amazon.com/security/security-bulletins/rss/2026-078-aws/
Officially imported this from Amazon Web Services’s own source and shows an extract. If you work there, claiming the profile and verifying the domain lets you choose to show the full text here.
This publication has changed since it was first published
2 versions recorded. The original is kept in full — nothing is overwritten.
- v2 imported change on current
- v1 as first published on
Provenance
- Organization
- Amazon Web Services — imported from official source
- Official source
- https://aws.amazon.com/security/security-bulletins/feed/ RSS
- Imported
- September 15, 2026 20:57
- Versions
- 2 recorded
- Identity
d13bbab33c554e52898d53000ddd9174dbd143ae