Opensearch Dashboards vulnerabilities

3 vulnerabilities

Known vulnerabilities in Opensearch Dashboards, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.7CVE-2026-84942opensearchopensearch dashboards
EPSS score
0.54%
Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The checkForFunctionProperty validation routine failed to recurse into arrays of objects, allowing a function property nested inside an array to bypass validation.8.8CVE-2026-18420awsamazon opensearch service+1
EPSS score
0.66%
Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enables remote code execution.  To remediate this issue, users should upgrade to OpenSearch Dashboards 3.8 or later.8.7CVE-2026-75897awsamazon opensearch service+1
EPSS score
0.72%
Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - might allow remote attackers to cause a denial of service via a crafted HTTP request.