AWS Amazon Opensearch Service vulnerabilities

2 vulnerabilities

Known vulnerabilities in AWS Amazon Opensearch Service, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.8CVE-2026-18420awsamazon opensearch service+1
EPSS score
0.66%
Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enables remote code execution.  To remediate this issue, users should upgrade to OpenSearch Dashboards 3.8 or later.8.7CVE-2026-75897awsamazon opensearch service+1
EPSS score
0.72%
Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - might allow remote attackers to cause a denial of service via a crafted HTTP request.