Server-Side Request Forgery in OpenSearch Dashboards from OpenSearch
CVE-2026-64686

5MEDIUM

Key Information:

Vendor

Opensearch-project

Status
Opensearch-dashboards
Vendor
CVE Published:
11 November 2026

What is CVE-2026-64686?

OpenSearch Dashboards, an open-source data visualization tool, has a vulnerability that allows authenticated users to exploit the fetchDataSourceMetaData route. This vulnerability permits users to submit internal or loopback endpoint URLs without adequate validation, potentially probing sensitive internal network resources. The issue arises as the related test_connection route performs necessary validations, which are not mirrored in the fetchDataSourceMetaData route. This oversight can lead to unintended exposure of network structures and resources. The vulnerability has been addressed in the released versions 2.19.6 and 3.7.0.

Affected Version(s)

OpenSearch-Dashboards >= 2.14.0, < 2.19.6 < 2.14.0, 2.19.6

OpenSearch-Dashboards >= 3.0.0, < 3.7.0 < 3.0.0, 3.7.0

References

https://github.com/opensearch-project/OpenSearch-Dashboar...
x_refsource_CONFIRM
https://github.com/opensearch-project/OpenSearch-Dashboar...
x_refsource_MISC
https://github.com/opensearch-project/OpenSearch-Dashboar...
x_refsource_MISC

CVSS V3.1

Score:
5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.