Amazon OpenSearch Stored XSS Vulnerability Advisory (CVE-2026-77811)

Vulnerability Overview CVE ID: CVE-2026-77811 Vulnerability Type: Stored Cross-Site Scripting (Stored Cross-Site Scripting, XSS) Description: Amazon OpenSearch Service is a managed service for deploying, operating, and scaling OpenSearch clusters. A stored cross-site scripting vulnerability was identified in the plugin of OpenSearch Dashboards. Inadequate input validation allows authenticated remote users to execute malicious scripts by uploading custom integrations containing arbitrary JavaScript code. When other users access the static file endpoint, the script executes within their browser session, enabling actions to be performed on their behalf, including calls to the OpenSearch API. Scope of Impact Affected Versions: - OpenSearch Dashboards dashboards-observability plugin (Open Source, Self-Managed): - Affected versions: 3.4 and earlier, and 2.19.6 and earlier - Fixed versions: 3.4 and 2.19.6 - Amazon OpenSearch Service (AWS Managed): - Affected versions: 3.3 and earlier - Fixed versions: All affected versions have been patched via service software updates Remediation Mitigation Steps: - For all Amazon OpenSearch Service (Managed) versions and the OpenSearch Dashboards dashboards-observability plugin, upgrade to the latest version and ensure all derived code is patched to include this fix. - For OpenSearch (Open Source), this issue is resolved in the OpenSearch Dashboards dashboards-observability plugin by upgrading to the latest version and patching all derived code to include this fix. - For Amazon OpenSearch Service (Managed), this issue is resolved in all affected versions. We recommend upgrading to the latest service software version as soon as possible. An engine version upgrade is not required. You can apply this by navigating to Actions > Service Software Version and clicking Update. Domains with automatic software update windows require no action. For more information, refer to Service Software Updates in Amazon OpenSearch Service. Additional Information References: - CVE-2026-77811 - GitHub Repository - OpenSearch Release Notes Contact If you have any security-related questions or concerns, please email aws-security@amazon.com.

Goal Reached Thanks to every supporter — we hit 100%!

Amazon OpenSearch Stored XSS Vulnerability Advisory (CVE-2026-77811)