OpenSearch Dashboards EUVD-2026-63592

The attacker must hold a valid authenticated session in OpenSearch Dashboards with at minimum low-level access (PR:L per CVSS 4.0). The TSVB plugin is bundled with standard OpenSearch Dashboards installations and is enabled by default - no special configuration is required to enable the vulnerable endpoint. Exploitation is entirely blocked for unauthenticated users; anonymous access to the metrics API is not sufficient. Attack complexity is low (AC:L) with no additional attack requirements (AT:N), meaning no race conditions, specific timing, or non-default configurations are needed beyond having a user account. The attack targets the server-side Node.js process of OpenSearch Dashboards specifically; direct OpenSearch data nodes are not the exploit target, though they may be secondarily impacted via post-exploitation data access.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 8.7 and signals a network-exploitable, low-complexity attack with full impact on the vulnerable system's confidentiality, integrity, and availability. The authentication requirement (PR:L) is the only meaningful friction: any user with a dashboard login can reach the TSVB metrics API endpoint. No EPSS score is present in the provided intelligence, so probabilistic comparison is not possible. The CVE is not in the CISA KEV catalog, meaning no confirmed active exploitation has been reported - however, absence from KEV does not imply low risk given that prototype pollution-to-RCE chains in Node.js applications are a well-understood and frequently weaponized attack class. The CVSS 4.0 subsequent-system impact metrics (SC:N/SI:N/SA:N) indicate the scope is bounded to the Dashboards server process itself, though RCE on that host may still expose indexed data from connected OpenSearch clusters. Organizations running OpenSearch Dashboards as a shared internal analytics platform - regardless of size - should treat this as an urgent patch given that any authenticated user, including low-trust internal accounts, can trigger full server compromise.

An attacker with a valid low-privileged OpenSearch Dashboards account - such as a read-only analyst account - sends a POST request to the TSVB metrics visualization API endpoint containing a JSON payload crafted with prototype pollution keys (e.g., __proto__ or constructor.prototype containing injected function references). The Node.js server processes the payload without adequate sanitization, corrupting the prototype chain of global objects in the runtime. The attacker leverages this to execute arbitrary code in the context of the Dashboards server process, enabling data exfiltration from connected OpenSearch indices or lateral movement to backend infrastructure. No public proof-of-concept exploit has been identified at time of analysis.