Vulnerability · Published Aug 20, 2026 · Assigned by AMZN

CVE-2026-18420RCE via Prototype Pollution in OpenSearch Dashboards

High 8.8

In plain English

A high-severity prototype pollution in Amazon OpenSearch Service from AWS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.0%top 38.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enables remote code execution. To remediate this issue, users should upgrade to OpenSearch Dashboards 3.8 or later.

Affected products (as reported)

Vendor	Product	Versions
AWS	Amazon OpenSearch Service	3.0.0 – before 3.8.0
OpenSearch	OpenSearch Dashboards	3.0.0 – before 3.8.0

Weakness: CWE-1321 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/opensearch-project/OpenSearch-Dashboards/releases/tag/3.8.0 patch
https://github.com/opensearch-project/OpenSearch-Dashboards/security/advisories/GHSA-xmqx-xq2p-8jq2 third-party-advisory
https://aws.amazon.com/security/security-bulletins/2026-085-aws/ vendor-advisory