CVE-2026-18952
Awaiting Analysis Awaiting Analysis - Queue

Server-Side Request Forgery in OpenSearch Security Analytics Plugin

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: AMZN

Description
Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-13
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-18952
EUVD
EUVD-2026-57422

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
amazon opensearch_security_analytics_plugin From 2.15.0 (inc)
amazon opensearch_security_analytics_plugin to 3.5.0 (inc)
amazon opensearch_service From 3.5.0 (inc)
opensearch security_analytics_plugin *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Missing input validation in the threat intelligence feed parser of the OpenSearch Security Analytics plugin allows an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint.

Detection Guidance

Check OpenSearch Security Analytics plugin version with: curl -XGET 'http://localhost:9200/_nodes/plugins?pretty' | grep -i 'security_analytics'. Verify if version is below 3.5.0. Inspect network logs for outbound requests from OpenSearch nodes to localhost or internal metadata endpoints.

Impact Analysis

An attacker with the security_analytics_full_access role could exploit this to make unauthorized requests from the server and access sensitive local files, potentially leading to data breaches or further network compromise.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating confidentiality requirements in GDPR and HIPAA. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade to plugin version 3.5.0 or later if using open-source deployments. For Amazon OpenSearch Service, apply the service software update for engine version 3.5. If immediate upgrade is not possible, restrict access to the security_analytics_full_access role and block outbound requests from OpenSearch nodes to localhost and internal metadata endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18952. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart