OpenSearch Dashboards EUVD-2026-61064

No authentication is required (CVSS PR:N) and no user interaction is needed (UI:N). Attack complexity is low (AC:L) with no specific attack requirements (AT:N), meaning the vulnerability is exploitable against any OpenSearch Dashboards instance that is network-reachable on its HTTP/HTTPS port. The only prerequisite is the ability to send an HTTP request to the capabilities endpoint. Exploitation is limited by: (1) network accessibility - instances bound only to localhost or protected by a firewall or VPN are not directly reachable; (2) the impact ceiling is denial of service only, with no confidentiality or integrity exposure; (3) AWS-managed OpenSearch Service deployments may have service-layer controls that absorb or rate-limit such requests independently of the application vulnerability.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) scores 8.7, driven entirely by high availability impact and the absence of any barrier to exploitation: no authentication, no user interaction, low complexity, and no special attack requirements. This makes network-exposed Dashboards instances directly reachable by any attacker who can send HTTP traffic. The impact is confined to availability - confidentiality and integrity are unaffected, which limits the scenario to service disruption rather than data compromise or lateral movement. No EPSS data was provided in the intelligence feed, and the vulnerability has not been added to CISA KEV, suggesting exploitation is not yet confirmed in the wild. No public proof-of-concept code has been identified. While the attack is trivially executable, the real-world urgency depends heavily on whether Dashboards is internet-facing: internally-restricted deployments face substantially lower risk due to network controls. AWS-managed OpenSearch Service customers should consult the vendor advisory, as AWS may have applied mitigations at the managed service layer independently of customer-side upgrades.

An unauthenticated attacker sends a single crafted HTTP request with an arbitrarily large body to the capabilities route handler endpoint on a network-accessible OpenSearch Dashboards instance. The server buffers and attempts to process the oversized payload, exhausting available memory or CPU on the Node.js process. Repeated requests, or a single sufficiently large payload, render the Dashboards service unresponsive, denying legitimate users access to the search and analytics interface. No public proof-of-concept has been identified, but the attack requires no special tooling beyond a standard HTTP client.