CVE-2026-18952: Aws Opensearch

High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days.

Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint.

Affected products

• Aws Opensearch: from 2.15.0, before 3.5.0 (fixed in 3.5.0)
• GitHub Opensearch: from 2.15.0, before 3.7.0 (fixed in 3.7.0)

Published 2026-08-12. Last modified 2026-08-21.