CVE-2026-19311
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters.
Risk Assessment
Risk of unauthorized access to index data, potentially leading to confidentiality, integrity, and availability breaches.
Recommendation
Apply vendor patches and restrict access to the Execute Monitor API to trusted users only.
Original NVD description (English source)
Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters.