Executive brief
OpenSearch Dashboards is the open-source visualization and management interface for OpenSearch clusters. A flaw in the capabilities request handler fails to validate the size of incoming requests, allowing attackers to send specially crafted HTTP requests that consume excessive server resources and cause service denial. This affects both self-managed OpenSearch deployments and Amazon's managed OpenSearch Service.
Technical details
The vulnerability is an uncontrolled resource consumption flaw in the capabilities route handler of OpenSearch Dashboards, where the handler fails to properly validate or bound the size of incoming request payloads. This improper input validation allows remote attackers to exploit the handler by sending a specially crafted HTTP request with an excessively large payload, triggering unbounded resource consumption that leads to denial of service. The vulnerability is unauthenticated and requires only network access to the capabilities endpoint. The flaw was inherited from upstream Kibana and affects self-managed OpenSearch versions 1.3.0 through 3.7.0 (including all 2.x versions up to 2.19.6) as well as corresponding Amazon OpenSearch Service engine versions. Patches are available: OpenSearch 3.8.0+ and patched service software releases for Amazon OpenSearch Service across all affected engine versions.
Affected products
- OpenSearch Project OpenSearch Dashboards 1.3.0 through 3.7.0 inclusive, including all 2.x versions up to 2.19.6
- Amazon Web Services Amazon OpenSearch Service Engine versions 1.3, 2.11, 2.13, 2.15, 2.17, 2.19, 3.1, 3.3, 3.5, and Elasticsearch-compatibility versions using Kibana 7.9 and 7.10
- Elastic Kibana 7.7.1 through 7.10.2
Timeline
- 2026-08-18: disclosed: AWS Security Bulletin 2026-082-AWS published
- 2026-09-09: advisory: CVE-2026-75897 published
- 2026: patched: OpenSearch Dashboards 3.8.0 fixes the vulnerability; patched service software releases available for Amazon OpenSearch Service