EUVD-2026-64129Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network delivery confirmed; PR:L reflects mandatory authenticated write access; S:C captures browser-context scope change enabling victim session hijacking.
Primary rating from Vendor (AMZN).
CVSS VectorVendor: AMZN
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenticated user with write permissions to OpenSearch Dashboards saved objects to execute arbitrary JavaScript in the context of other users' browser sessions by uploading a saved asset with arbitrary web content.
AnalysisAI
Stored cross-site scripting in the OpenSearch Dashboards dashboards-observability plugin allows a remote authenticated user with write permissions to saved objects to inject arbitrary JavaScript that executes in other users' browser sessions. Affected deployments include both self-hosted OpenSearch Dashboards and Amazon OpenSearch Service (managed). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an attacker to hold a valid OpenSearch Dashboards account with write permissions to saved objects - unauthenticated users cannot trigger this vulnerability, and accounts without saved-object write access are not sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N scoring 8.7 (High) is well-calibrated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a low-privilege OpenSearch Dashboards account - obtained through credential compromise or insider access - crafts a saved observability asset containing a malicious JavaScript payload and uploads it via the dashboards-observability plugin's saved asset functionality. When an administrator or higher-privilege user subsequently opens that saved asset in their browser, the script executes under the victim's session context, exfiltrating session tokens or API keys to an attacker-controlled endpoint and enabling impersonation of the victim within OpenSearch Dashboards. … |
| Remediation | Upgrade OpenSearch Dashboards to version 3.4.0 (for 3.x deployments) or 2.19.0 (for 2.x deployments), both confirmed as fixed releases available at https://opensearch.org/artifacts/by-version/#release-3-4-0 and https://opensearch.org/artifacts/by-version/#release-2-19-0 respectively. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all OpenSearch Dashboards deployments and identify instances running affected plugin versions prior to 2.19.0 or 3.4.0, paying particular attention to multi-tenant or shared environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Amazon Opensearch Service
View allRemote code execution in OpenSearch Dashboards 3.0.0-3.7.x allows an authenticated low-privileged user to fully compromi
Unbounded HTTP request payload processing in OpenSearch Dashboards' capabilities route handler allows unauthenticated re
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today