# CVE-2026-75897: OpenSearch Dashboards uncontrolled resource consumption in capabilities route

Source: https://junglewise.ai/threats/cve-2026-75897-opensearch-dashboards-uncontrolled-resource-consumption-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75897 · Severity: high · CVSS 7.5 · Published 2026-09-09

OpenSearch Dashboards is the open-source visualization and management interface for OpenSearch clusters. A flaw in the capabilities request handler fails to validate the size of incoming requests, allowing attackers to send specially crafted HTTP requests that consume excessive server resources and cause service denial. This affects both self-managed OpenSearch deployments and Amazon's managed OpenSearch Service.

Technologies: [Amazon AWS](https://junglewise.ai/threats/technologies/aws), [Elastic Kibana](https://junglewise.ai/threats/technologies/kibana), [OpenSearch Project OpenSearch Dashboards](https://junglewise.ai/threats/technologies/opensearch-dashboards). Vendors: [Amazon](https://junglewise.ai/threats/vendors/amazon), [Amazon Web Services](https://junglewise.ai/threats/vendors/amazon-web-services), [Elastic](https://junglewise.ai/threats/vendors/elastic), [OpenSearch Project](https://junglewise.ai/threats/vendors/opensearch-project).

## Quick answers

**Is CVE-2026-75897 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75897 being exploited in the wild.

**How severe is CVE-2026-75897?** High severity, with a CVSS score of 7.5, published 9 September 2026.

**Which products and versions are affected?** Amazon Web Services OpenSearch Service Engine versions 1.3, 2.11, 2.13, 2.15, 2.17, 2.19, 3.1, 3.3, 3.5, and Elasticsearch-compatibility versions using Kibana 7.9 and 7.10; Elastic Kibana 7.7.1 through 7.10.2; OpenSearch Project OpenSearch Dashboards 1.3.0 through 3.7.0 inclusive, including all 2.x versions up to 2.19.6.

**Is there a fix for CVE-2026-75897?** A patch was published on 2026: OpenSearch Dashboards 3.8.0 fixes the vulnerability; patched service software releases available for Amazon OpenSearch Service Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75897 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-75897?** Check whether you run Amazon AWS, Amazon Web Services OpenSearch Service, Elastic Kibana or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an uncontrolled resource consumption flaw in the capabilities route handler of OpenSearch Dashboards, where the handler fails to properly validate or bound the size of incoming request payloads. This improper input validation allows remote attackers to exploit the handler by sending a specially crafted HTTP request with an excessively large payload, triggering unbounded resource consumption that leads to denial of service. The vulnerability is unauthenticated and requires only network access to the capabilities endpoint. The flaw was inherited from upstream Kibana and affects self-managed OpenSearch versions 1.3.0 through 3.7.0 (including all 2.x versions up to 2.19.6) as well as corresponding Amazon OpenSearch Service engine versions. Patches are available: OpenSearch 3.8.0+ and patched service software releases for Amazon OpenSearch Service across all affected engine versions.

## Affected products

- OpenSearch Project OpenSearch Dashboards 1.3.0 through 3.7.0 inclusive, including all 2.x versions up to 2.19.6
- Amazon Web Services Amazon OpenSearch Service Engine versions 1.3, 2.11, 2.13, 2.15, 2.17, 2.19, 3.1, 3.3, 3.5, and Elasticsearch-compatibility versions using Kibana 7.9 and 7.10
- Elastic Kibana 7.7.1 through 7.10.2

## Timeline

- 2026-08-18: disclosed: AWS Security Bulletin 2026-082-AWS published
- 2026-09-09: advisory: CVE-2026-75897 published
- 2026: patched: OpenSearch Dashboards 3.8.0 fixes the vulnerability; patched service software releases available for Amazon OpenSearch Service

## References

- [https://aws.amazon.com/security/security-bulletins/rss/2026-082-aws/](https://aws.amazon.com/security/security-bulletins/rss/2026-082-aws/)

## Related threats

- [An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0)](https://junglewise.ai/threats/cve-2026-126793-privilege-escalation-in-aurora-postgresql-dialect-detection-in)
- [AWS SDK for pandas EMR unverified bucket ownership](https://junglewise.ai/threats/cve-2026-127119-unverified-ownership-of-the-default-emr-cluster-log-location-in)
- [Amazon mcp-gateway-registry server-side request forgery in registration API](https://junglewise.ai/threats/cve-2026-125926-server-side-request-forgery-in-the-server-registration-and)
- [Amazon mcp-gateway-registry authorization bypass in management API](https://junglewise.ai/threats/cve-2026-100307-missing-authorization-on-the-external-management-api-in-mcp)
- [OpenSearch Dashboards Server-Side Request Forgery in data source endpoint validation](https://junglewise.ai/threats/cve-2026-64686-opensearch-dashboards-is-an-open-source-data-visualization-tool)