Improper Input Validation in OpenSearch Dashboards Plugin
CVE-2026-77811

6.2MEDIUM

Key Information:

Vendor

Aws

Status
Amazon Opensearch Service
Opensearch Dashboards Dashboards-observability Plugin
Vendor
CVE Published:
21 August 2026

What is CVE-2026-77811?

A vulnerability exists in the dashboards-observability plugin for OpenSearch Dashboards that permits a remote authenticated user with write privileges to execute arbitrary JavaScript in the browser sessions of other users. This occurs through improper input validation, allowing the attacker to upload a saved asset containing malicious web content. As a result, this can expose other users to security risks, making it critical for users to update to patched versions of the plugin to mitigate potential exploitation.

Affected Version(s)

OpenSearch Dashboards dashboards-observability plugin 0 < 3.4

OpenSearch Dashboards dashboards-observability plugin 0 < 2.19.6

Amazon OpenSearch Service 0

References

https://opensearch.org/artifacts/by-version/#release-3-4-0
patch
https://opensearch.org/artifacts/by-version/#release-2-19-6
patch
https://aws.amazon.com/security/security-bulletins/2026-0...
vendor-advisory

CVSS V4

Score:
6.2
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.