Skip to main content

CVE-2026-18420 - Remote Code Execution via Prototype Pollution in OpenSearch Dashboards TSVB Plugin

Bulletin ID: 2026-085-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 08/20/2026 13:30 PM PDT

Description:

Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards before 3.8 allows a remote authenticated user with standard data access permissions to execute arbitrary code on the server by sending a crafted JSON payload to the metrics visualization API endpoint. To mitigate this issue, users should upgrade to OpenSearch Dashboards 3.8 or later.

Impacted products and versions:

  • OpenSearch-Dashboards(open-source, self-managed): >= 3.0.0, < 3.8.0
  • OpenSearch-Dashboards (AWS Managed): >= 3.0.0, < 3.8.0

Resolution:

  • OpenSearch-Dashboards(open-source, self-managed):
    Upgrade to version >= 3.8.0, and ensuring any forked or derivative code is patched to incorporate the new fixes.
  • OpenSearch-Dashboards (AWS Managed):
    Apply the latest available service software update to your domain. The OpenSearch Service console Notifications panel indicates when an update is available for your domain. For instructions, see Service software updates in Amazon OpenSearch Service.

Workarounds:

Disable TSVB plugin util OpenSearch-Dashboards is upgraded to a fixed version.

References:


Please email aws-security@amazon.com with any security questions or concerns.