Executive brief
OpenSearch Dashboards is an open-source analytics and visualization platform used to monitor and analyze data in OpenSearch clusters. A stored cross-site scripting vulnerability in the dashboards-observability plugin allows authenticated users with write permissions to inject malicious JavaScript into integration templates. When other users access these templates, the JavaScript executes in their browsers, enabling attackers to steal data, perform unauthorized actions, or compromise user sessions.
Technical details
CVE-2026-77811 is a stored cross-site scripting (XSS) vulnerability in the dashboards-observability plugin of OpenSearch Dashboards, caused by improper input validation in the integrations static file endpoint. An authenticated remote actor with write permissions to OpenSearch Dashboards saved objects can upload a custom integration template containing arbitrary JavaScript code. When another user accesses the static file endpoint directly, the malicious script executes in their browser context with their privileges, allowing the attacker to perform API calls to OpenSearch on behalf of the victim, access sensitive data, or modify settings. The vulnerability requires authentication and write access to saved objects, but does not require user interaction beyond normal access to the integrations UI. Patches are available for OpenSearch Dashboards versions 3.4 and 2.19.6; AWS-managed OpenSearch Service has been updated across all affected versions via service software updates.
Affected products
- OpenSearch OpenSearch Dashboards dashboards-observability plugin before 3.4 and before 2.19.6
- Amazon OpenSearch Service before 3.3
Timeline
- 2026-08-21: disclosed: AWS security bulletin published
- 2026-09-09: advisory: Advisory published with CVE-2026-77811
- 2026-08-21: patched: Fixed in OpenSearch Dashboards 3.4 and 2.19.6; AWS OpenSearch Service patched via service software update