GitHub Vulnerabilities and Affected Products
Vulnerabilities associated with Opensearch.
Products
Clear product- Enterprise Server82 vulnerabilities
- GitHub Enterprise Server46 vulnerabilities
- enterprise_server15 vulnerabilities
- cmark-gfm10 vulnerabilities
- Opensearch3 vulnerabilities
- cli2 vulnerabilities
- codeql-action2 vulnerabilities
- copilot-cli2 vulnerabilities
- github-mcp-server2 vulnerabilities
- codeql-cli-binaries1 vulnerability
- github1 vulnerability
- go-gh1 vulnerability
- paste-markdown1 vulnerability
- secure_headers1 vulnerability
- trilogy1 vulnerability
- view_component1 vulnerability
- vscode-codeql1 vulnerability
- Webiness Inventory1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-18428HIGH | SQL Query Validation Bypass in OpenSearch Direct QueryA SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint. CWE-693Aug 13, 2026 | CVSS8.7v4.0 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-18952HIGH | Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics PluginMissing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint. CWE-918Aug 12, 2026 | CVSS8.6v4.0 | EPSS0.32% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-19311HIGH | Missing Authorization in Execute Monitor API in OpenSearch Alerting PluginMissing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters. CWE-475Aug 12, 2026 | CVSS8.6v4.0 | EPSS0.415% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |