CVE-2026-77811
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
The dashboards-observability plugin in OpenSearch Dashboards has an improper input validation vulnerability. A remote authenticated user with write permissions to saved objects can execute arbitrary JavaScript in the context of other users' browser sessions by uploading a saved asset with arbitrary web content.
Risk Assessment
An attacker can hijack other users' sessions, steal data, or perform unauthorized actions on their behalf, posing a serious security threat.
Recommendation
Apply vendor-provided patches or restrict write permissions to saved objects to trusted users only.
Other vulnerabilities in OpenSearch Dashboards
See all- CVE-2026-18420High
The Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards has an improper input validation vulnerability that allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This is a form of prototype pollution leading to remote code execution.
- CVE-2026-75897High
Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - might allow remote attackers to cause a denial of service via a crafted HTTP request.
Original NVD description (English source)
Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenticated user with write permissions to OpenSearch Dashboards saved objects to execute arbitrary JavaScript in the context of other users' browser sessions by uploading a saved asset with arbitrary web content.