OpenSearch vulnerabilities

3 known vulnerabilities in OpenSearch from GitHub. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Opensearch: Protection Mechanism Failure

  CVE-2026-18428Aug 13, 2026AWS

  A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query end

• 8.1 High severity

  OpenSearch: Undefined Behavior for Input to API

  CVE-2026-19311Aug 12, 2026AWS

  Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index p

• 8.1 High severity

  Opensearch: Server-Side Request Forgery

  CVE-2026-18952Aug 12, 2026AWS

  Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel sou