Is CVE-2026-64686 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-64686 being exploited in the wild.

How severe is CVE-2026-64686?

Medium severity, with a CVSS score of 5, published 11 November 2026.

Which products and versions are affected?

OpenSearch Project OpenSearch Dashboards 2.14.0 before 2.19.6, 3.0.0 before 3.7.0.

Is there a fix for CVE-2026-64686?

Yes: fixed in OpenSearch Dashboards 2.19.6, 3.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-64686 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-64686?

Check whether you run OpenSearch Project OpenSearch Dashboards at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-64686: OpenSearch Dashboards Server-Side Request Forgery in data source endpoint validation

CVE-2026-64686 · Severity: medium · CVSS 5 · Published 2026-11-11

OpenSearch Dashboards is an open-source data visualization platform used to analyze data from OpenSearch clusters. A vulnerability in how it validates data source endpoints allows authenticated users to bypass security controls and probe internal network resources, potentially exposing sensitive infrastructure information or enabling further attacks.

Technologies: OpenSearch Project OpenSearch Dashboards. Vendors: OpenSearch Project.

Quick answers

Is CVE-2026-64686 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-64686 being exploited in the wild.
How severe is CVE-2026-64686?: Medium severity, with a CVSS score of 5, published 11 November 2026.
Which products and versions are affected?: OpenSearch Project OpenSearch Dashboards 2.14.0 before 2.19.6, 3.0.0 before 3.7.0.
Is there a fix for CVE-2026-64686?: Yes: fixed in OpenSearch Dashboards 2.19.6, 3.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-64686 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-64686?: Check whether you run OpenSearch Project OpenSearch Dashboards at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: OpenSearch Dashboards 2.19.6, 3.7.0

Technical details

The fetchDataSourceMetaData API route in OpenSearch Dashboards fails to validate endpoint URLs against configured security blocklists (endpointDeniedIPs and endpointAllowlistedSuffixes), while the sibling test_connection route performs proper validation. An authenticated attacker can submit arbitrary internal or loopback endpoints to the unvalidated route to conduct SSRF attacks and reconnaissance on internal network resources.

Affected products

OpenSearch Project OpenSearch Dashboards 2.14.0 before 2.19.6, 3.0.0 before 3.7.0

Timeline

2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.