aws.amazon.comVendor advisoryrelease notes
https://aws.amazon.com/security/security-bulletins/2026-079-aws CVE-2026-18952
HIGH
Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics Plugin
Record summary
CVE-2026-18952 has a selected CVSS score of 8.6 (high).
Description
Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 13, 2026 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
OpensearchBrowse AWS / OpensearchDefault status: unaffected | CVE List | 2.15.0 to < 3.5.0 | affected |
OpensearchBrowse Github / OpensearchDefault status: unaffected | CVE List | 2.15.0 to < 3.5.0 | affected |
References
2docs.aws.amazon.compatch
https://docs.aws.amazon.com/opensearch-service/latest/developerguide/service-software.html