Vulnerability Description
Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enables remote code execution. To remediate this issue, users should upgrade to OpenSearch Dashboards 3.8 or later.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://aws.amazon.com/security/security-bulletins/2026-085-aws/
- https://github.com/opensearch-project/OpenSearch-Dashboards/releases/tag/3.8.0
- https://github.com/opensearch-project/OpenSearch-Dashboards/security/advisories/
FAQ
What is CVE-2026-18420?
CVE-2026-18420 is a vulnerability with a CVSS score of 8.8 (HIGH). Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payloa...
How severe is CVE-2026-18420?
CVE-2026-18420 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-18420?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.