CVE-2026-18952— Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics Plugin
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| AWS | Opensearch | 2.15.0< 3.5.0 | affected |
| Github | Opensearch | 2.15.0< 3.5.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-18952
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics Plugin
Source: CVE Program / CVE List V5
Vulnerability Description
Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Vulnerability Title
OpenSearch Security Analytics plugin 服务端请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OpenSearch Security Analytics plugin是OpenSearch组织的一款安全检测与威胁分析插件。 OpenSearch Security Analytics plugin 2.15.0版本至3.5.0之前版本存在服务端请求伪造漏洞，该漏洞源于威胁情报feed解析器缺少输入验证，可能允许经过身份验证的远程用户通过构造的URL参数对威胁情报源配置端点执行服务端请求伪造并读取本地文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| AWS | Opensearch | 2.15.0 ~ 3.5.0 | - | |
| Github | Opensearch | 2.15.0 ~ 3.5.0 | - |
II. Public POCs for CVE-2026-18952
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-18952
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-18952 (1)
- 🔗 CVE-2026-18952 - Missing Input Validation in OpenSearch Security Analytics Plugin Read full article vendor-advisoryrelease-notes
Same Patch Batch · AWS · 2026-08-12 · 4 CVEs total
| CVE-2026-19311 | 8.1 HIGH | Missing Authorization in Execute Monitor API in OpenSearch Alerting Plugin |
| CVE-2026-19642 | 5.9 MEDIUM | Out-of-bounds write in the Base64 decoder in Amazon aws-sdk-cpp |
| CVE-2026-19643 | 5.3 MEDIUM | Out-of-bounds read in the Base64 decoder in Amazon aws-sdk-cpp on signed-char platforms |
IV. Related Vulnerabilities
Same product: Opensearch
- CVE-2026-18428
SQL Query Validation Bypass in OpenSearch Direct Query - CVE-2026-19311
Missing Authorization in Execute Monitor API in OpenSearch A - CVE-2025-9624
OpenSearch 3.2.0 - Nested Boolean/Disjunction asymmetric DoS - CVE-2024-54160
OpenSearch Dashboards Reports 安全漏洞 - CVE-2022-41917
Incorrect Error Handling Allowed Partial File Reads Over RES
Same vendor: AWS
- CVE-2026-18428
SQL Query Validation Bypass in OpenSearch Direct Query - CVE-2026-19643
Out-of-bounds read in the Base64 decoder in Amazon aws-sdk-c - CVE-2026-19642
Out-of-bounds write in the Base64 decoder in Amazon aws-sdk- - CVE-2026-19311
Missing Authorization in Execute Monitor API in OpenSearch A - CVE-2026-19111
Insecure direct object reference in Strands Agents Tools mem
Same weakness: CWE-918
- CVE-2026-19984
jkawamoto mcp-florence2 __init__.py get_images server-side r - CVE-2026-19957
graphlit graphlit-mcp-server ssrf-test Endpoint tools.ts fet - CVE-2026-19956
gomarble-ai facebook-ads-mcp-server server.py fetch_paginati - CVE-2026-73058
stoatchat before 0.15.0 SSRF via IPv6 unspecified address by - CVE-2026-17123
Royal Addons for Elementor <= 1.7.1064 - Authenticated (Cont
V. Comments for CVE-2026-18952
No comments yet