Skip to main content

OpenSearch Security Analytics CVE-2026-18952

| EUVDEUVD-2026-57422 HIGH
Server-Side Request Forgery (SSRF) (CWE-918)
2026-08-12 AMZN
Intel SSRF Opensearch
8.6
CVSS 4.0 · Vendor: AMZN
Share

Severity by source

Vendor (AMZN) PRIMARY
8.6 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.1 HIGH

Network-reachable with low-privilege authentication required; high C and I reflect credential and data exposure via SSRF; no availability impact; scope unchanged as vendor scored no subsequent-system impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (AMZN).

CVSS VectorVendor: AMZN

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 12, 2026 - 19:21 vuln.today
CVE Published
Aug 12, 2026 - 18:42 cve.org
HIGH 8.6

DescriptionCVE.org

Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint.

AnalysisAI

Server-side request forgery and local file read in the OpenSearch Security Analytics plugin exposes authenticated users with low privileges as a vector for internal network reconnaissance and credential theft. The flaw resides in the threat intelligence feed parser, which fails to validate URL parameters submitted to the threat intel source configuration endpoint, allowing a crafted request to redirect server-side HTTP fetches to internal resources - including cloud metadata endpoints. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate with low-privileged OpenSearch credentials
Delivery
Navigate to threat intel source configuration endpoint
Exploit
Submit POST with crafted internal URL as feed source
Execution
OpenSearch server performs server-side HTTP fetch
Persist
Response with internal data or cloud credentials returned
Impact
Attacker reads exfiltrated credential or file content
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid authenticated session with at minimum low-level user privileges on an OpenSearch cluster where the Security Analytics plugin is installed and the threat intelligence feed feature is accessible - the CVSS PR:L metric confirms authentication is mandatory, meaning unauthenticated external attackers cannot directly trigger this flaw. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) presents a consistent picture: network-reachable, low-complexity exploitation requiring only a low-privileged authenticated account, with high confidentiality and integrity impact to the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated attacker holding any low-privileged account on an OpenSearch cluster with the Security Analytics plugin enabled submits a POST request to the threat intel source configuration endpoint, specifying a crafted URL such as http://169.254.169.254/latest/meta-data/iam/security-credentials/ as the feed source. The OpenSearch server fetches the URL server-side and the attacker reads the response body, obtaining temporary IAM role credentials that can be used for lateral movement within the AWS environment. …
Remediation Apply the vendor-released patch as directed by Amazon's security bulletin AWS-2026-079, available at https://aws.amazon.com/security/security-bulletins/2026-079-aws/. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, audit OpenSearch deployments to identify instances with Security Analytics plugin enabled. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Opensearch

View all
CVE-2022-31115 HIGH POC
8.8 Jun 30

opensearch-ruby is a community-driven, open source fork of elasticsearch-ruby. Rated high severity (CVSS 8.8), this vuln
CVE-2025-9624 HIGH POC
8.3 Nov 25

A vulnerability in OpenSearch allows attackers to cause Denial of Service (DoS) by submitting complex query_string input
CVE-2026-18428 HIGH
8.7 Aug 13

Remote code execution via the OpenSearch SQL plugin's Flint extension query handler exposes Apache Spark workers to arbi
CVE-2023-23612 HIGH
8.8 Jan 26

OpenSearch is an open source distributed and RESTful search engine. Rated high severity (CVSS 8.8), this vulnerability i
CVE-2026-19311 HIGH
8.6 Aug 12

Missing authorization in the Execute Monitor API of the Amazon OpenSearch Alerting plugin allows any authenticated remot
CVE-2022-35980 HIGH
7.5 Aug 12

OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. Rated high seve
CVE-2023-23613 MEDIUM
6.5 Jan 26

OpenSearch is an open source distributed and RESTful search engine. Rated medium severity (CVSS 6.5), this vulnerability
CVE-2022-41918 MEDIUM
6.3 Nov 15

OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. Rated medium severity (CVSS 6.3), this v
CVE-2023-31141 MEDIUM
5.9 May 08

OpenSearch is open-source software suite for search, analytics, and observability applications. Rated medium severity (C
CVE-2023-45807 MEDIUM
5.4 Oct 16

OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 202
CVE-2023-25806 MEDIUM
5.3 Mar 02

OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. Rated medium se
CVE-2023-23933 MEDIUM
4.3 Feb 03

OpenSearch Anomaly Detection identifies atypical data and receives automatic notifications. Rated medium severity (CVSS

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2022-41040 HIGH POC
8.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2023-48022 CRITICAL POC
9.8

Same technique SSRF

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-21975 HIGH POC
7.5
CVE-2016-3718 MEDIUM POC
5.5
CVE-2026-15409 CRITICAL POC
10.0

Share

CVE-2026-18952 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy