CVE-2026-19311- Missing Authorization in OpenSearch Alerting Plugin
Amazon OpenSearch ยท 2026-10-21
Actions
Technical Details
| Affected Versions | 2.4.0 through 2.19.5, 3.0.0 through 3.7.0 |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-19311 |
| Migration Required | Yes |
| Cost Impact | Neutral |
| IaC Impact | High |
What This Means
For DevOps Teams
Update OpenSearch Alerting Plugin to version 2.19.6 or 3.8.0, and ensure Amazon OpenSearch Service domains are running the latest service software to address CVE-2026-19311 and prevent unauthorized data access.
For Platform Teams
Deploy the latest OpenSearch Alerting Plugin and service software updates to maintain secure and compliant data operations, reducing the risk of unauthorized data modifications.
For Executives
Implement immediate updates to mitigate CVE-2026-19311, a critical security vulnerability in OpenSearch Alerting Plugin, to prevent unauthorized data access and modifications, ensuring data integrity and compliance.
Source
Related Amazon OpenSearch Updates
- Amazon OpenSearch Serverless now supports a 5-second default refresh interval (2026-10-22)
- CVE-2026-18952 - Missing Input Validation in OpenSearch Security Analytics Plugin (2026-10-21)
- CVE-2026-18420 - Remote Code Execution via Prototype Pollution in OpenSearch Dashboards TSVB Plugin (2026-10-21)
- CVE-2026-18428 - OpenSearch SQL Plugin - Async Query Validation Bypass (2026-10-21)
- CVE-2026-83497 - OpenSearch SQL Plugin - Unrestricted Java Deserialization in Cursor Pagination (2026-10-21)