Skip to content
CVE PROGRAM SOURCE RECORD8.6 High

CVE-2026-19311

Missing Authorization in Execute Monitor API in OpenSearch Alerting Plugin

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
AMZN

Description

Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

AWS OpenSearch

Default version status: unaffected

  • 2.4 to ≤ 3.5affected

Github OpenSearch

Default version status: unaffected

  • 2.4.0 to ≤ 2.19.5affected
  • 3.0.0 to ≤ 3.7.0affected

References