CVE-2026-18420 - Remote Code Execution via Prototype Pollution in OpenSearch Dashboards TSVB Plugin
Cybersecurity Classified by Officially
CVE-2026-18420 - Remote Code Execution via Prototype Pollution in OpenSearch Dashboards TSVB Plugin
Bulletin ID: 2026-085-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 08/20/2026 13:30 PM PDT
Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards before 3.8 allows a remote authenticated user with standard data access permissions to execute arbitrary code on the server by sending a crafted JSON payload to the metrics visualization API endpoint. To mitigate this issue, users should upgrade to OpenSearch Dashboards 3.8 or later.
Upgrade to version >= 3.8.0, and ensuring any forked or derivative code is patched to incorporate the new fixes.
Apply the latest available service software update to your domain. The OpenSearch Service console Notifications panel indicates when an update is available for your domain. For instructions, see Service software updates in Amazon OpenSearch Service.
Disable TSVB plugin util OpenSearch-Dashboards is upgraded to a fixed version.
This is an extract. The publication continues at the source.
Read the original at the source: https://aws.amazon.com/security/security-bulletins/rss/2026-085-aws/
Officially imported this from Amazon Web Services’s own source and shows an extract. If you work there, claiming the profile and verifying the domain lets you choose to show the full text here.
Provenance
- Organization
- Amazon Web Services — imported from official source
- Official source
- https://aws.amazon.com/security/security-bulletins/feed/ RSS
- Imported
- September 18, 2026 09:42
- Versions
- 1 recorded
- Identity
29269334545db0f7e3891f34d6a3cd0e9b163364