Opensearch vulnerabilities
8 vulnerabilities
Known vulnerabilities in Opensearch products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 4 products.
Products
4- Opensearch Dashboards3 vulnerabilities
- Observability2 vulnerabilities
- Opensearch2 vulnerabilities
- Opensearch Dashboards Dashboards Observability Plugin1 vulnerabilities
CVE-2025-9624amazonopensearch+46
EPSS score0.68%
A vulnerability in OpenSearch allows attackers to cause Denial of Service (DoS) by submitting complex query_string inputs.
This issue affects all OpenSearch versions between 3.0.0 and < 3.3.0 and OpenSearch < 2.19.4.CVE-2024-39901org.opensearch.pluginopensearch-observability+2EPSS score0.29%
OpenSearch Observability is collection of plugins and applications that visualize data-driven events. An issue in the OpenSearch observability plugins allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14.CVE-2024-39900org.opensearch.pluginopensearch-reports-scheduler+2EPSS score0.30%
OpenSearch Dashboards Reports allows ‘Report Owner’ export and share reports from OpenSearch Dashboards. An issue in the OpenSearch reporting plugin allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14.CVE-2026-84942opensearchopensearch dashboardsEPSS score0.54%
Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The checkForFunctionProperty validation routine failed to recurse into arrays of objects, allowing a function property nested inside an array to bypass validation.CVE-2026-77811opensearchopensearch dashboards dashboards-observability pluginEPSS score0.52%
Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenticated user with write permissions to OpenSearch Dashboards saved objects to execute arbitrary JavaScript in the context of other users' browser sessions by uploading a saved asset with arbitrary web content.CVE-2026-18420awsamazon opensearch service+1EPSS score0.66%
Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enables remote code execution.
To remediate this issue, users should upgrade to OpenSearch Dashboards 3.8 or later.CVE-2026-83497amazonamazon opensearch service+1EPSS score0.96%
Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search permissions to execute arbitrary code on the server by sending a crafted cursor parameter to the plugins/sql endpoint.CVE-2026-75897awsamazon opensearch service+1EPSS score0.72%
Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - might allow remote attackers to cause a denial of service via a crafted HTTP request.