Bulletin ID: 2026-078-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 08/12/2026 11:30 AM PDT

Description:

OpenSearch is a community-driven, open-source search and analytics suite. We identified CVE-2026-19311, a missing authorization issue in the Execute Monitor API of the OpenSearch Alerting plugin. This issue may allow an authenticated user with the alerting_full_access role to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters.

Impacted Versions:

OpenSearch Alerting Plugin (open-source, self-managed):

• Affected: 2.4.0 through 2.19.5, 3.0.0 through 3.7.0
• Fixed: 2.19.6, 3.8.0

Amazon OpenSearch Service (AWS Managed):

• Affected: All domains running engine versions 2.4 through 3.5
• Fixed: Service software R20260428-P3

Resolution:

• OpenSearch Alerting Plugin (open-source, self-managed):
  Upgrade to OpenSearch 2.19.6 or 3.8.0 or later. The update addresses an input validation issue in the Execute Monitor API. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
• Amazon OpenSearch Service (AWS Managed):
  We recommend that customers update their domains to the latest service software version as soon as possible. No engine version upgrade is required. You can apply the update from the console by selecting your domain, choosing Actions, Service Software Version, then clicking Update. Domains with automatic software updates enabled receive this update during their next off-peak window with no action required. For full details, see Service software updates in Amazon OpenSearch Service.

Workarounds:

If immediate upgrade is not possible, restrict the alerting_full_access role to only trusted administrative users to minimize visibility to this issue.

References:

• CVE-2026-19311
• GHSA-xxpg-q3wh-685q

Please email aws-security@amazon.com with any security questions or concerns.