CVE-2026-18952 - Missing Input Validation in OpenSearch Security Analytics Plugin

Imported from official source

September 09, 2026 21:30 Security notice

Cybersecurity Classified by Officially

CVE-2026-18952 - Missing Input Validation in OpenSearch Security Analytics Plugin

Bulletin ID: 2026-079-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 08/12/2026 11:45 AM PDT
Last updated: 08/21/2026 12:00 PM PDT

OpenSearch is a community-driven, open-source search and analytics suite. We identified CVE-2026-18952, a missing input validation issue in the threat intelligence feed parser of the OpenSearch Security Analytics plugin. This issue may allow an authenticated user with the security_analytics_full_access role to perform server-side request forgery (SSRF) and read local files via a crafted URL parameter to the threat intel source configuration endpoint.

OpenSearch Security Analytics Plugin (open-source, self-managed):

Amazon OpenSearch Service (AWS Managed):

Affected: Domains running engine versions >= 2.15.0

Fixed: Addressed via service software update for engine version 3.7. The affected functionality is not enabled in the default service configuration.

OpenSearch Security Analytics Plugin (open-source, self-managed):
Upgrade to the version specified in the associated security advisory when available. The update addresses an input validation issue in the threat intelligence feed configuration.

Amazon OpenSearch Service (AWS Managed):
We recommend that customers update their domains to the latest service software version as soon as possible. No engine version upgrade is required. You can apply the update from the console by selecting your domain, choosing Actions, Service Software Version, then clicking Update. Domains with automatic software updates enabled receive this update during their next off-peak window with no action required. For full details, see Service software updates in Amazon OpenSearch Service.

This is an extract. The publication continues at the source.

Read the original at the source: https://aws.amazon.com/security/security-bulletins/rss/2026-079-aws/

Officially imported this from Amazon Web Services’s own source and shows an extract. If you work there, claiming the profile and verifying the domain lets you choose to show the full text here.

This publication has changed since it was first published

2 versions recorded. The original is kept in full — nothing is overwritten.

v2 imported change on September 17, 2026 21:30 current
v1 as first published on September 15, 2026 20:57

Provenance

Organization: Amazon Web Services — imported from official source
Official source: https://aws.amazon.com/security/security-bulletins/feed/ RSS
Imported: September 15, 2026 20:57
Versions: 2 recorded
Identity: a44ef221ab37a9fd52f29a6ecdfaabbca1f356e0