CVE-2026-18952 - Missing Input Validation in OpenSearch Security Analytics Plugin
Amazon OpenSearch ยท 2026-10-21
Actions
Technical Details
| Affected Versions | >= 2.15.0 |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-18952 |
| Migration Required | Yes |
| Cost Impact | Neutral |
| IaC Impact | High |
What This Means
For DevOps Teams
Update OpenSearch Security Analytics Plugin to version >= 3.7.0 and apply the latest service software update for Amazon OpenSearch Service to address the input validation issue and prevent SSRF attacks.
For Platform Teams
Deploy the updated OpenSearch Security Analytics Plugin and service software to enhance security posture and protect against potential SSRF attacks and unauthorized file access.
For Executives
Implement the security update for OpenSearch to mitigate the risk of SSRF attacks and unauthorized file access, ensuring data integrity and compliance with security standards.
Source
Related Amazon OpenSearch Updates
- Amazon OpenSearch Serverless now supports a 5-second default refresh interval (2026-10-22)
- CVE-2026-19311- Missing Authorization in OpenSearch Alerting Plugin (2026-10-21)
- CVE-2026-18420 - Remote Code Execution via Prototype Pollution in OpenSearch Dashboards TSVB Plugin (2026-10-21)
- CVE-2026-18428 - OpenSearch SQL Plugin - Async Query Validation Bypass (2026-10-21)
- CVE-2026-83497 - OpenSearch SQL Plugin - Unrestricted Java Deserialization in Cursor Pagination (2026-10-21)