Executive brief
OpenSearch Dashboards' Time Series Visual Builder (TSVB) plugin contains an input validation flaw that allows authenticated users to send malicious JSON payloads to the metrics visualization API, leading to remote code execution on the server. This vulnerability could enable an attacker with dashboard access to take complete control of the OpenSearch infrastructure and access sensitive data stored within it.
Technical details
The vulnerability is a prototype pollution flaw in the TSVB plugin's metrics visualization API endpoint. The plugin fails to properly validate and sanitize JSON input before processing it, allowing an attacker to inject malicious properties that pollute the prototype chain and achieve arbitrary code execution on the server. The attack requires authentication to OpenSearch Dashboards and network access to the API endpoint. An authenticated attacker can craft a malicious JSON payload targeting the metrics visualization API to execute arbitrary code with the privileges of the OpenSearch process. The vulnerability was patched in OpenSearch Dashboards version 3.8.0 and later.
Affected products
- OpenSearch Project OpenSearch Dashboards prior to 3.8.0
Timeline
- 2026-08-20: disclosed
- 2026-09-01: patched: Fixed in OpenSearch Dashboards 3.8.0