CVE-2026-18420CWE-1321

CVE-2026-18420

High · published August 21, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
51.1
In the wild
Unconfirmed
What it is

Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enables remote code execution.

To remediate this issue, users should upgrade to OpenSearch Dashboards 3.8 or later.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00664 · 51.1th percentile
Weakness
CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Published
2026-08-21T01:17Z
References (3)
https://aws.amazon.com/security/security-bulletins/2026-085-aws/ · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/opensearch-project/OpenSearch-Dashboards/releases/tag/3.8.0 · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/opensearch-project/OpenSearch-Dashboards/security/advisories/GHSA-xmqx-xq2p-8jq2 · ff89ba41-3aa1-4d27-914a-91399e9639e5
EPSS history
Timeline
  • 20 AUG 20:40Z
    RCE via Prototype Pollution in OpenSearch Dashboards
    cvelistv5