Skip to main content

OpenSearch Dashboards EUVDEUVD-2026-63592

| CVE-2026-18420 HIGH
Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)
2026-08-20 AMZN GHSA-jhcc-gw3q-f4pc
Prototype Pollution RCE Amazon Opensearch Service Opensearch Dashboards
8.7
CVSS 4.0 · Vendor: AMZN
Share

Severity by source

Vendor (AMZN) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.8 HIGH

Network-reachable API requires only low-privilege authentication; scope unchanged as subsequent-system impact is not indicated by vendor data.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (AMZN).

CVSS VectorVendor: AMZN

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Analysis Generated
Aug 20, 2026 - 21:31 vuln.today
CVSS changed
Aug 20, 2026 - 21:22 NVD
8.8 (HIGH) 8.7 (HIGH)
CVE Published
Aug 20, 2026 - 20:40 cve.org
HIGH 8.7

DescriptionCVE.org

Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enables remote code execution.

To remediate this issue, users should upgrade to OpenSearch Dashboards 3.8 or later.

AnalysisAI

Remote code execution in OpenSearch Dashboards 3.0.0-3.7.x allows an authenticated low-privileged user to fully compromise the server via a prototype pollution flaw in the Time Series Visual Builder (TSVB) plugin. By sending a crafted JSON payload to the metrics visualization API endpoint, an attacker can corrupt the Node.js object prototype chain and achieve arbitrary server-side code execution. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate with low-privileged dashboard account
Delivery
Craft JSON payload with prototype pollution keys
Exploit
POST payload to TSVB metrics visualization API
Execution
Corrupt Node.js server prototype chain
Persist
Execute arbitrary code on Dashboards server
Impact
Exfiltrate OpenSearch indexed data or pivot to backend
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must hold a valid authenticated session in OpenSearch Dashboards with at minimum low-level access (PR:L per CVSS 4.0). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 8.7 and signals a network-exploitable, low-complexity attack with full impact on the vulnerable system's confidentiality, integrity, and availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with a valid low-privileged OpenSearch Dashboards account - such as a read-only analyst account - sends a POST request to the TSVB metrics visualization API endpoint containing a JSON payload crafted with prototype pollution keys (e.g., `__proto__` or `constructor.prototype` containing injected function references). The Node.js server processes the payload without adequate sanitization, corrupting the prototype chain of global objects in the runtime. …
Remediation Upgrade to OpenSearch Dashboards 3.8.0 or later, the vendor-confirmed fix version per the GitHub release (https://github.com/opensearch-project/OpenSearch-Dashboards/releases/tag/3.8.0) and AWS security bulletin 2026-085 (https://aws.amazon.com/security/security-bulletins/2026-085-aws/). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all OpenSearch Dashboards instances running versions 3.0.0-3.7.x and audit which users have metrics visualization API access. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Prototype Pollution

View all
CVE-2026-34621 HIGH POC
8.6 Apr 11

Prototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execu
CVE-2024-56059 CRITICAL
9.8 Dec 18

Prototype pollution in the farinspace Partners WordPress plugin (versions up to and including 0.2.0) enables remote unau
CVE-2020-28271 CRITICAL POC
9.8 Nov 12

Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service
CVE-2023-38894 CRITICAL POC
9.8 Aug 16

A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code vi
CVE-2024-24292 CRITICAL POC
9.8 Mar 28

A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function
CVE-2023-26121 CRITICAL POC
10.0 Apr 11

All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper s
CVE-2021-23449 CRITICAL POC
10.0 Oct 18

This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitr
CVE-2024-39011 CRITICAL POC
9.8 Jul 30

Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Ser
CVE-2024-38988 CRITICAL POC
9.8 Mar 28

alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/inde
CVE-2025-57347 CRITICAL POC
9.8 Sep 24

A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConf
CVE-2025-57321 CRITICAL POC
9.8 Sep 24

A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 all
CVE-2024-45435 CRITICAL POC
9.8 Aug 29

Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function. Rated critical severity (CVSS 9.8), this

Same weakness CWE-1321 – Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)

View all
CVE-2026-34621 HIGH POC
8.6
CVE-2024-56059 CRITICAL
9.8
CVE-2020-28271 CRITICAL POC
9.8
CVE-2023-38894 CRITICAL POC
9.8
CVE-2024-24292 CRITICAL POC
9.8
CVE-2023-26121 CRITICAL POC
10.0
CVE-2021-23449 CRITICAL POC
10.0
CVE-2024-39011 CRITICAL POC
9.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Share

EUVD-2026-63592 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy