# CVE-2026-64686: OpenSearch Dashboards Server-Side Request Forgery in data source endpoint validation

Source: https://junglewise.ai/threats/cve-2026-64686-opensearch-dashboards-is-an-open-source-data-visualization-tool  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-64686 · Severity: medium · CVSS 5 · Published 2026-11-11

OpenSearch Dashboards is an open-source data visualization platform used to analyze data from OpenSearch clusters. A vulnerability in how it validates data source endpoints allows authenticated users to bypass security controls and probe internal network resources, potentially exposing sensitive infrastructure information or enabling further attacks.

Technologies: [OpenSearch Project OpenSearch Dashboards](https://junglewise.ai/threats/technologies/opensearch-dashboards). Vendors: [OpenSearch Project](https://junglewise.ai/threats/vendors/opensearch-project).

## Quick answers

**Is CVE-2026-64686 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-64686 being exploited in the wild.

**How severe is CVE-2026-64686?** Medium severity, with a CVSS score of 5, published 11 November 2026.

**Which products and versions are affected?** OpenSearch Project OpenSearch Dashboards 2.14.0 before 2.19.6, 3.0.0 before 3.7.0.

**Is there a fix for CVE-2026-64686?** Yes: fixed in OpenSearch Dashboards 2.19.6, 3.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-64686 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-64686?** Check whether you run OpenSearch Project OpenSearch Dashboards at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in OpenSearch Dashboards 2.19.6, 3.7.0

## Technical details

The fetchDataSourceMetaData API route in OpenSearch Dashboards fails to validate endpoint URLs against configured security blocklists (endpointDeniedIPs and endpointAllowlistedSuffixes), while the sibling test_connection route performs proper validation. An authenticated attacker can submit arbitrary internal or loopback endpoints to the unvalidated route to conduct SSRF attacks and reconnaissance on internal network resources.

## Affected products

- OpenSearch Project OpenSearch Dashboards 2.14.0 before 2.19.6, 3.0.0 before 3.7.0

## Timeline

- 2026-11-11: disclosed

## References

- [https://github.com/opensearch-project/OpenSearch-Dashboards/releases/tag/2.19.6](https://github.com/opensearch-project/OpenSearch-Dashboards/releases/tag/2.19.6)
- [https://github.com/opensearch-project/OpenSearch-Dashboards/releases/tag/3.7.0](https://github.com/opensearch-project/OpenSearch-Dashboards/releases/tag/3.7.0)

## Related threats

- [OpenSearch Dashboards uncontrolled resource consumption in capabilities route](https://junglewise.ai/threats/cve-2026-75897-opensearch-dashboards-uncontrolled-resource-consumption-in)
- [OpenSearch Dashboards stored XSS via Vega expression function bypass](https://junglewise.ai/threats/cve-2026-84942-opensearch-dashboards-stored-xss-via-vega-expression-function)
- [OpenSearch Dashboards TSVB plugin prototype pollution remote code execution](https://junglewise.ai/threats/cve-2026-18420-opensearch-dashboards-tsvb-plugin-prototype-pollution-remote-code)