CVE-2026-18952

Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint.

Score

CVSS 4.0 8.6 High

Status

Awaiting Analysis - ff89ba41-3aa1-4d27-914a-91399e9639e5

Published

2026-08-12

Last modified

2026-08-21

Weaknesses

CWE-918

Affected products

• Opensearch (Aws)
• Opensearch (Github)

References

• https://aws.amazon.com/security/security-bulletins/2026-079-aws/
• https://docs.aws.amazon.com/opensearch-service/latest/developerguide/service-software.html
• https://github.com/opensearch-project/security-analytics/security/advisories/GHSA-w946-8jxc-6v3m