CVE-2026-84942 - Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards
Opensearch Dashboards ยท 2026-10-25
Actions
Technical Details
| Affected Versions | v2.0.0, v2.1.0, v2.2.0, v2.3.0, v2.4.0, v2.5.0, v2.6.0, v2.7.0, v2.8.0, v2.9.0, v2.10.0, v2.11.0, v2.12.0, v2.13.0, v2.14.0, v2.15.0, v2.16.0, v2.17.0, v2.18.0, v2.19.0, v3.0.0, v3.1.0, v3.2.0, v3.3.0, v3.4.0, v3.5.0 |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-84942 |
| Migration Required | Yes |
| Cost Impact | Neutral |
| IaC Impact | High |
What This Means
For DevOps Teams
Update OpenSearch Dashboards to versions 2.19.5 or 3.6.0, and ensure Amazon OpenSearch Service domains are running the latest service software version to address the stored XSS vulnerability (CVE-2026-84942).
For Platform Teams
Integrate the latest OpenSearch Dashboards versions into your deployment pipelines to ensure the Vega expression function is properly validated, reducing the risk of XSS attacks.
For Executives
Implement immediate updates to OpenSearch Dashboards to mitigate the risk of stored cross-site scripting attacks, ensuring the security and integrity of your data visualizations and user sessions.
Source
Related Opensearch Dashboards Updates
- CVE-2026-84942 - Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards (2026-10-23)
- CVE-2026-75897 - Uncontrolled resource consumption in OpenSearch Dashboards capabilities route (2026-10-21)
- CVE-2026-77811 - Stored Cross-Site Scripting via Integration Template Asset in OpenSearch Dashboards (2026-10-21)
- Amazon RDS Custom now supports the latest Cumulative Update and GDR updates for Microsoft SQL Server (2026-10-19)
- PostgreSQL 19 RC1 is now available in Amazon RDS Database Preview Environment (2026-10-15)