Missing Input Validation in OpenSearch Security Analytics Plugin

Bulletin ID: 2026-079-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 08/12/2026 11:45 AM PDT Last updated: 08/21/2026 12:00 PM PDT Description: OpenSearch is a community-driven, open-source search and analytics suite. We identified CVE-2026-18952 , a missing input validation issue in the threat intelligence feed parser of the OpenSearch Security Analytics plugin. This issue may allow an authenticated user with the security_analytics_full_access role to perform server-side request forgery (SSRF) and read local files via a crafted URL parameter to the threat intel source configuration endpoint. Impacted Versions: OpenSearch Security Analytics Plugin (open-source, self-managed): Affected:  >= 2.15.0 Fixed:  >= 3.7.0 Amazon OpenSearch Service (AWS Managed): Affected:  Domains running engine versions >= 2.15.0 Fixed:  Addressed via service software update for engine version 3.7 . The affected functionality is not enabled in the default service configuration. Resolution: OpenSearch Security Analytics Plugin (open-source, self-managed): Upgrade to the version specified in the associated security advisory when available. The update addresses an input validation issue in the threat intelligence feed configuration. Amazon OpenSearch Service (AWS Managed): We recommend that customers update their domains to the latest service software version as soon as possible. No engine version upgrade is required. You can apply the update from the console by selecting your domain, choosing Actions, Service Software Version, then clicking Update. Domains with automatic software updates enabled receive this update during their next off-peak window with no action required. For full details, see Service software updates in Amazon OpenSearch Service . Workarounds: If immediate upgrade is not possible, restrict access to the security_analytics_full_access role to only trusted users. Additionally, network policies or proxy rules can be applied to block outbound requests from OpenSearch nodes to localhost and internal metadata endpoints. References: CVE-2026-18952 GHSA-w946-8jxc-6v3 Please email aws-security@amazon.com with any security questions or concerns. "},"metadata":{"tags":[]}},{"fields":{"patternBoolean2":"false","id":"ams#rt-rich-textc2#pattern-data"},"metadata":{"tags":[{"name":"pattern-data","description":"Default pattern data","id":"ams#rt-rich-textc2#pattern-data","namespaceId":"rt-rich-text"}]}}]},"metadata":{"auth":{},"testAttributes":{}},"context":{"page":{"pageUrl":"https://aws.amazon.com/security/security-bulletins/2026-079-aws/"},"contentType":"page","environment":{"stage":"prod","region":"us-west-2"},"sdkVersion":"2.0.27"},"refMap":{"manifest.js":"cda3e8d042","rt-rich-text.js":"5043b0a87f","rt-rich-text.rtl.css":"6a04028f86","rt-rich-text.css":"98f5a6aee4","rt-rich-text.css.js":"3d619cc2e1","rt-rich-text.rtl.css.js":"ccdb945d3e"},"settings":{"templateMappings":{"patternHeading":"patternHeading","patternSubheading":"patternSubheading","patternDark":"patternBoolean2","title":"itemHeading","bodyText":"itemLongLoc"}}} CVE-2026-18952 - Missing Input Validation in OpenSearch Security Analytics Plugin Bulletin ID: 2026-079-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 08/12/2026 11:45 AM PDT Last updated: 08/21/2026 12:00 PM PDT Description: OpenSearch is a community-driven, open-source search and analytics suite. We identified CVE-2026-18952 , a missing input validation issue in the threat intelligence feed parser of the OpenSearch Security Analytics plugin. This issue may allow an authenticated user with the security_analytics_full_access role to perform server-side request forgery (SSRF) and read local files via a crafted URL parameter to the threat intel source configuration endpoint. Impacted Versions: OpenSearch Security Analytics Plugin (open-source, self-managed): Affected:  >= 2.15.0 Fixed:  >= 3.7.0 Amazon OpenSearch Service (AWS Managed): Aff

Severity from

no source yet

• aws.amazon.com/security/security-bulletins/rss/2026-079-aws/
• www.cve.org/CVERecord?id=CVE-2026-18952