OpenSearch Security Analytics EUVD-2026-57422

Exploitation requires a valid authenticated session with at minimum low-level user privileges on an OpenSearch cluster where the Security Analytics plugin is installed and the threat intelligence feed feature is accessible - the CVSS PR:L metric confirms authentication is mandatory, meaning unauthenticated external attackers cannot directly trigger this flaw. The specific vulnerable entry point is the threat intel source configuration endpoint, triggered by supplying a crafted URL parameter to the feed parser. Clusters without the Security Analytics plugin installed or where the threat intelligence ingestion feature is disabled are not exposed. The practical impact of a successful SSRF depends on the network topology of the OpenSearch host: exploitation yields the most severe consequences on cloud-hosted instances (AWS EC2/ECS) where the metadata service is reachable at link-local addresses, potentially exposing IAM role credentials. On-premises or air-gapped deployments face lower but non-zero risk from access to internal HTTP services on the same network segment.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) presents a consistent picture: network-reachable, low-complexity exploitation requiring only a low-privileged authenticated account, with high confidentiality and integrity impact to the vulnerable system. The PR:L constraint is the primary limiting factor - unauthenticated external attackers cannot directly trigger the flaw, but any user account with access to the Security Analytics plugin configuration is sufficient. EPSS data was not provided in the source intelligence, so probabilistic exploitation likelihood cannot be quantified; however, SSRF vulnerabilities targeting cloud-hosted services are a well-understood and actively pursued attack class given the potential to harvest IAM credentials from metadata endpoints. The vulnerability is not listed in CISA KEV and no POC has been identified, but even a mid-sized municipal IT team in bytom running OpenSearch with the Security Analytics plugin should treat this as urgent given how accessible low-privileged credentials can be in multi-tenant or shared cluster deployments. The vendor-assigned 8.6 CVSS 4.0 score appropriately reflects the real-world severity - the absence of active exploitation evidence does not diminish the structural risk.

An authenticated attacker holding any low-privileged account on an OpenSearch cluster with the Security Analytics plugin enabled submits a POST request to the threat intel source configuration endpoint, specifying a crafted URL such as http://169.254.169.254/latest/meta-data/iam/security-credentials/ as the feed source. The OpenSearch server fetches the URL server-side and the attacker reads the response body, obtaining temporary IAM role credentials that can be used for lateral movement within the AWS environment. No public proof-of-concept code has been identified, though the SSRF technique targeting AWS metadata endpoints is well-documented and requires no novel tooling.