CVE-2026-19311 is a missing authorization vulnerability in the Execute Monitor API of the OpenSearch Alerting plugin. This flaw allows an authenticated user with the alerting_full_access role to perform unauthorized read, modify, or delete operations on arbitrary index data by crafting inline monitor requests with manipulated data source and input index parameters. The vulnerability affects OpenSearch Alerting Plugin versions 2.4.0 through 2.19.5 and 3.0.0 through 3.7.0, and Amazon OpenSearch Service domains running engine versions 2.4 through 3.5. The issue is addressed in OpenSearch Alerting Plugin versions 2.19.6 and 3.8.0, and in Amazon OpenSearch Service software update R20260428-P3. AWS advises upgrading to these fixed versions or applying the service software update. As a temporary mitigation, restricting the alerting_full_access role to trusted administrative users can reduce risk.

An authenticated user with the alerting_full_access role can exploit this vulnerability to read, modify, or delete arbitrary index data in the OpenSearch cluster. This could lead to unauthorized data exposure, data tampering, or data loss within affected OpenSearch environments. The impact is limited to users who already have the alerting_full_access role but can be significant depending on the sensitivity of the indexed data.

For self-managed OpenSearch Alerting Plugin deployments, upgrade to version 2.19.6, 3.8.0, or later to apply the official fix. For Amazon OpenSearch Service, apply the service software update R20260428-P3 via the AWS console or allow automatic updates to apply the patch during the next maintenance window. If immediate upgrade or patching is not feasible, restrict the alerting_full_access role to only trusted administrative users to minimize exposure to this vulnerability.