CVE-2026-18420

Received Received - Intake

Prototype Pollution Leading to RCE in OpenSearch Dashboards

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: AMZN

Description

Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enables remote code execution. To remediate this issue, users should upgrade to OpenSearch Dashboards 3.8 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-20

Last Modified

2026-08-20

Generated

2026-08-21

AI Q&A

2026-08-21

EPSS Evaluated

N/A

NVD

CVE-2026-18420

EUVD

EUVD-2026-63592

Affected Vendors & Products

Vendor	Product	Version / Range
opensearch	dashboards	3.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1321	The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

Executive Summary

This vulnerability is an improper input validation flaw in the Time Series Visual Builder (TSVB) plugin within OpenSearch Dashboards. An authenticated remote user can exploit it by sending a specially crafted JSON payload to the metrics visualization API endpoint. The issue stems from prototype pollution, which allows the attacker to execute arbitrary code on the server.

Impact Analysis

If exploited, this vulnerability could allow an attacker to run malicious code on the server hosting OpenSearch Dashboards. This could lead to unauthorized access, data breaches, or disruption of services. The impact depends on the server's role and the data it handles.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations could face legal penalties, reputational damage, and loss of trust if such incidents occur due to unpatched systems.

Mitigation Strategies

Upgrade OpenSearch Dashboards to version 3.8 or later to remediate the vulnerability.

Hi! I’m here to help you understand CVE-2026-18420. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70