OpenSearch vulnerabilities
We track 6 vulnerabilities in OpenSearch products across 3 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on September 8, 2026.
Latest OpenSearch vulnerabilities
- 8.7 High severity
Amazon OpenSearch Service: Improper Neutralization of Input During Web Page Generation
Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a c
- 8.8 High severity
OpenSearch: Deserialization of Untrusted Data
Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search permissions to execute arbitrary code on the server by sending a crafted cursor parameter t
- 8.7 High severity
Amazon OpenSearch Service: Improper Neutralization of Input During Web Page Generation
Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenticated user with write permissions to OpenSearch Dashboards saved objects to execute arbitrary JavaScript in the context of other users' browser se
- 8.8 High severity
Amazon OpenSearch Service: Improperly Controlled Modification of Object Prototype Attributes
Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a
- 7.5 High severity
OpenSearch Dashboards: Improper Validation of Specified Quantity in Input
Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - might allow remote attackers to cause a denial of service via a crafted HTTP request.
- 7.5 High severity
OpenSearch: Uncontrolled Recursion
A vulnerability in OpenSearch allows attackers to cause Denial of Service (DoS) by submitting complex query_string inputs. This issue affects all OpenSearch versions between 3.0.0 and < 3.3.0 and OpenSearch < 2.19.4.