Vulnerability Description
Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://aws.amazon.com/about-aws/whats-new/2026/03/amazon-opensearch-service-ver
- https://aws.amazon.com/security/security-bulletins/2026-078-aws/
- https://github.com/opensearch-project/alerting/security/advisories/GHSA-xxpg-q3w
FAQ
What is CVE-2026-19311?
CVE-2026-19311 is a vulnerability with a CVSS score of 8.1 (HIGH). Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline moni...
How severe is CVE-2026-19311?
CVE-2026-19311 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-19311?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.