Missing Authorization in Amazon OpenSearch Alerting Plugin

CVE-2026-19311

What is CVE-2026-19311?

A critical security vulnerability exists in the Execute Monitor API of the Amazon OpenSearch Alerting plugin. This flaw allows an authenticated remote user to conduct unauthorized read, modification, or deletion of index data through a specially crafted inline monitor request. The absence of proper authorization checks permits unintended access to sensitive data, which could lead to serious security breaches. It is crucial for users to review their configurations and apply any necessary patches to mitigate potential risks.

References