# CVE-2026-84942: OpenSearch Dashboards stored XSS via Vega expression function bypass

Source: https://junglewise.ai/threats/cve-2026-84942-opensearch-dashboards-stored-xss-via-vega-expression-function  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-84942 · Severity: high · CVSS 8.7 · Published 2026-09-08

OpenSearch Dashboards is a visualization and analytics platform that allows users to create interactive dashboards from data. A stored cross-site scripting (XSS) vulnerability in the Vega visualization component allows authenticated users with dashboard editing permissions to inject malicious code that executes in other users' browsers when they view the affected dashboard, potentially leading to account compromise or unauthorized access to sensitive analytics data.

Technologies: [Amazon AWS](https://junglewise.ai/threats/technologies/aws), [OpenSearch Project OpenSearch Dashboards](https://junglewise.ai/threats/technologies/opensearch-dashboards). Vendors: [Amazon](https://junglewise.ai/threats/vendors/amazon), [OpenSearch Project](https://junglewise.ai/threats/vendors/opensearch-project).

## Quick answers

**Is CVE-2026-84942 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84942 being exploited in the wild.

**How severe is CVE-2026-84942?** High severity, with a CVSS score of 8.7, published 8 September 2026.

**Which products and versions are affected?** OpenSearch Project OpenSearch Dashboards v2.0.0 through v2.19.4; v3.0.0 through v3.5.0; fixed in v2.19.5 and v3.6.0.

**Is there a fix for CVE-2026-84942?** A patch was published on 2026-09-09: Patches released for OpenSearch Dashboards v2.19.5 and v3.6.0; AWS-managed versions patched Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84942 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-84942?** Check whether you run Amazon AWS or OpenSearch Project OpenSearch Dashboards at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored XSS flaw in how OpenSearch Dashboards processes Vega expression functions, enabling bypass of input sanitization controls. An authenticated attacker with dashboard write permissions can craft a malicious Vega visualization specification containing JavaScript code that gets stored in the dashboard configuration. When other users view the dashboard, the injected script executes in their browser context with their privileges, potentially enabling session hijacking, credential theft, or further unauthorized access. The attack requires prior authentication and dashboard modification capabilities but no user interaction beyond normal dashboard viewing. Patches are available in OpenSearch Dashboards v2.19.5 and v3.6.0 for self-managed deployments, and AWS-managed OpenSearch Service updates are available for all affected versions.

## Affected products

- OpenSearch Project OpenSearch Dashboards v2.0.0 through v2.19.4; v3.0.0 through v3.5.0; fixed in v2.19.5 and v3.6.0
- Amazon OpenSearch Service v2.3.0, v2.5.0, v2.7.0, v2.9.0, v2.11.0, v2.13.0, v2.15.0, v2.17.0, v2.19.0, v3.1.0, v3.3.0, v3.5.0

## Timeline

- 2026-09-09: disclosed: AWS Security Bulletin 2026-102-AWS published
- 2026-09-09: patched: Patches released for OpenSearch Dashboards v2.19.5 and v3.6.0; AWS-managed versions patched

## References

- [https://aws.amazon.com/security/security-bulletins/rss/2026-102-aws/](https://aws.amazon.com/security/security-bulletins/rss/2026-102-aws/)

## Related threats

- [An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0)](https://junglewise.ai/threats/cve-2026-126793-privilege-escalation-in-aurora-postgresql-dialect-detection-in)
- [AWS SDK for pandas EMR unverified bucket ownership](https://junglewise.ai/threats/cve-2026-127119-unverified-ownership-of-the-default-emr-cluster-log-location-in)
- [Amazon mcp-gateway-registry server-side request forgery in registration API](https://junglewise.ai/threats/cve-2026-125926-server-side-request-forgery-in-the-server-registration-and)
- [Amazon mcp-gateway-registry authorization bypass in management API](https://junglewise.ai/threats/cve-2026-100307-missing-authorization-on-the-external-management-api-in-mcp)
- [OpenSearch Dashboards Server-Side Request Forgery in data source endpoint validation](https://junglewise.ai/threats/cve-2026-64686-opensearch-dashboards-is-an-open-source-data-visualization-tool)