CVE-2026-18420 - Remote Code Execution via Prototype Pollution in OpenSearch Dashboards TSVB Plugin
Opensearch Service ยท 2026-10-21
Actions
Technical Details
| Affected Versions | >= 3.0.0, < 3.8.0 |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-18420 |
| Migration Required | Yes |
| Cost Impact | Neutral |
| IaC Impact | High |
What This Means
For DevOps Teams
Update OpenSearch Dashboards to version 3.8.0 or later to address CVE-2026-18420 and prevent potential remote code execution attacks.
For Platform Teams
Deploy the latest service software update for OpenSearch Service to incorporate critical security fixes and maintain system integrity.
For Executives
Implement immediate security patch to mitigate remote code execution risk in OpenSearch Dashboards TSVB Plugin to protect data integrity and system security.
Source
Related Opensearch Service Updates
- Amazon OpenSearch Serverless now supports a 5-second default refresh interval (2026-10-22)
- CVE-2026-18952 - Missing Input Validation in OpenSearch Security Analytics Plugin (2026-10-21)
- CVE-2026-19311- Missing Authorization in OpenSearch Alerting Plugin (2026-10-21)
- CVE-2026-18428 - OpenSearch SQL Plugin - Async Query Validation Bypass (2026-10-21)
- CVE-2026-83497 - OpenSearch SQL Plugin - Unrestricted Java Deserialization in Cursor Pagination (2026-10-21)