CVE-2026-18420
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
The Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards has an improper input validation vulnerability that allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This is a form of prototype pollution leading to remote code execution.
Risk Assessment
An authenticated user can execute arbitrary code on the server, potentially leading to full system compromise, data theft, or service disruption.
Recommendation
Upgrade OpenSearch Dashboards to version 3.8 or later, which includes the fix.
Other vulnerabilities in OpenSearch Dashboards
See all- CVE-2026-77811High
The dashboards-observability plugin in OpenSearch Dashboards has an improper input validation vulnerability. A remote authenticated user with write permissions to saved objects can execute arbitrary JavaScript in the context of other users' browser sessions by uploading a saved asset with arbitrary web content.
- CVE-2026-75897High
Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - might allow remote attackers to cause a denial of service via a crafted HTTP request.
Original NVD description (English source)
Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enables remote code execution. To remediate this issue, users should upgrade to OpenSearch Dashboards 3.8 or later.