This vulnerability (CVE-2026-18952) involves a lack of input validation in the threat intelligence feed parser component of the OpenSearch Security Analytics plugin. An authenticated remote user can exploit this flaw by providing a crafted URL parameter to the threat intelligence source configuration endpoint, enabling server-side request forgery (SSRF) and potentially reading local files. The vulnerability is identified as CWE-918 and affects OpenSearch version 2.15.0. AWS operates OpenSearch as a cloud service and is responsible for patching and mitigating this issue on their managed platform. The CVSS 4.0 score is 8.6, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

An authenticated remote attacker can exploit this SSRF vulnerability to make the server perform unauthorized requests, potentially accessing internal resources or reading local files. This can lead to sensitive information disclosure and further compromise of the affected system. The high CVSS score reflects the significant risk posed by this vulnerability in the AWS OpenSearch environment.

AWS manages remediation for this cloud-hosted service and is responsible for applying patches and mitigations server-side. Users of AWS OpenSearch should monitor the AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-079-aws/ for updates and ensure their managed service instances are updated accordingly. No additional user action is required beyond following AWS guidance.