CVE-2026-18952CWE-918ssrf

CVE-2026-18952

High · published August 12, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
43.3
In the wild
Unconfirmed
What it is

Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00519 · 43.3th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-08-12T23:17Z
References (3)
https://aws.amazon.com/security/security-bulletins/2026-079-aws/ · ff89ba41-3aa1-4d27-914a-91399e9639e5https://docs.aws.amazon.com/opensearch-service/latest/developerguide/service-software.html · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/opensearch-project/security-analytics/security/advisories/GHSA-w946-8jxc-6v3m · ff89ba41-3aa1-4d27-914a-91399e9639e5
EPSS history
Timeline
  • 12 AUG 18:42Z
    Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics Plugin
    cvelistv5