OpenSearch Dashboards EUVD-2026-64129

Exploitation requires an attacker to hold a valid OpenSearch Dashboards account with write permissions to saved objects - unauthenticated users cannot trigger this vulnerability, and accounts without saved-object write access are not sufficient. The attacker must upload or modify a saved asset within the dashboards-observability plugin to embed the malicious payload. A separate victim user must then actively view or open the malicious saved asset in their own browser session (UI:R). Exploitation is bounded by: (1) mandatory low-privilege authentication with specific saved-object write ACL, (2) social engineering or natural workflow dependency to induce a victim to open the asset, and (3) impact is limited to the victim's browser session context - there is no direct server-side code execution or file system access. Non-default access restrictions (e.g., fine-grained access control limiting who can create or share saved objects) would further reduce the exploitable population.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N scoring 8.7 (High) is well-calibrated. PR:L confirms this is not an unauthenticated threat - an attacker must hold a valid low-privilege account with write access to saved objects, substantially limiting opportunistic or mass exploitation. UI:R requires a victim to actively view the malicious saved asset, adding a social engineering dependency. The S:C scope change and C:H/I:H combination reflect serious downstream impact once triggered: session hijacking, credential theft, or admin-level action impersonation are realistic outcomes. No EPSS score was provided in available intelligence; KEV status is absent, meaning active exploitation by threat actors has not been confirmed by CISA at this time. No POC code has been identified. In practice, this vulnerability is most dangerous in multi-tenant Amazon OpenSearch Service deployments or shared analytics environments where multiple privilege levels access common dashboards. For single-tenant or strictly access-controlled deployments, the requirement for a malicious insider or compromised low-privilege account meaningfully reduces real-world likelihood.

An attacker with a low-privilege OpenSearch Dashboards account - obtained through credential compromise or insider access - crafts a saved observability asset containing a malicious JavaScript payload and uploads it via the dashboards-observability plugin's saved asset functionality. When an administrator or higher-privilege user subsequently opens that saved asset in their browser, the script executes under the victim's session context, exfiltrating session tokens or API keys to an attacker-controlled endpoint and enabling impersonation of the victim within OpenSearch Dashboards. No public POC has been identified, but the technique is a well-understood stored XSS pattern requiring only standard web exploitation knowledge.