CVE-2026-19311- Missing Authorization in OpenSearch Alerting Plugin
CVE-2026-19311 is a missing authorization vulnerability in the Execute Monitor API of the OpenSearch Alerting plugin. It affects self-managed OpenSearch Alerting Plugin versions 2.4.0 through 2.19.5 and 3.0.0 through 3.7.0, as well as Amazon OpenSearch Service domains running engine versions 2.4 through 3.5. An authenticated user with the alerting_full_access role could exploit this flaw to read, modify, or delete arbitrary index data via crafted inline monitor requests. Fixes are available in OpenSearch Alerting Plugin versions 2.19.6 and 3.8.0 and in the Amazon OpenSearch Service software update R20260428-P3. AWS recommends upgrading promptly or restricting the alerting_full_access role to trusted users if immediate upgrade is not possible.
AI Analysis
Technical Summary
CVE-2026-19311 is a missing authorization vulnerability in the Execute Monitor API of the OpenSearch Alerting plugin. This flaw allows an authenticated user with the alerting_full_access role to perform unauthorized read, modify, or delete operations on arbitrary index data by crafting inline monitor requests with manipulated data source and input index parameters. The vulnerability affects OpenSearch Alerting Plugin versions 2.4.0 through 2.19.5 and 3.0.0 through 3.7.0, and Amazon OpenSearch Service domains running engine versions 2.4 through 3.5. The issue is addressed in OpenSearch Alerting Plugin versions 2.19.6 and 3.8.0, and in Amazon OpenSearch Service software update R20260428-P3. AWS advises upgrading to these fixed versions or applying the service software update. As a temporary mitigation, restricting the alerting_full_access role to trusted administrative users can reduce risk.
Potential Impact
An authenticated user with the alerting_full_access role can exploit this vulnerability to read, modify, or delete arbitrary index data in the OpenSearch cluster. This could lead to unauthorized data exposure, data tampering, or data loss within affected OpenSearch environments. The impact is limited to users who already have the alerting_full_access role but can be significant depending on the sensitivity of the indexed data.
Mitigation Recommendations
For self-managed OpenSearch Alerting Plugin deployments, upgrade to version 2.19.6, 3.8.0, or later to apply the official fix. For Amazon OpenSearch Service, apply the service software update R20260428-P3 via the AWS console or allow automatic updates to apply the patch during the next maintenance window. If immediate upgrade or patching is not feasible, restrict the alerting_full_access role to only trusted administrative users to minimize exposure to this vulnerability.
CVE-2026-19311- Missing Authorization in OpenSearch Alerting Plugin
Description
CVE-2026-19311 is a missing authorization vulnerability in the Execute Monitor API of the OpenSearch Alerting plugin. It affects self-managed OpenSearch Alerting Plugin versions 2.4.0 through 2.19.5 and 3.0.0 through 3.7.0, as well as Amazon OpenSearch Service domains running engine versions 2.4 through 3.5. An authenticated user with the alerting_full_access role could exploit this flaw to read, modify, or delete arbitrary index data via crafted inline monitor requests. Fixes are available in OpenSearch Alerting Plugin versions 2.19.6 and 3.8.0 and in the Amazon OpenSearch Service software update R20260428-P3. AWS recommends upgrading promptly or restricting the alerting_full_access role to trusted users if immediate upgrade is not possible.
Affected software
pkg:maven/org.opensearch.alerting/opensearch-alerting-pluginRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-19311 is a missing authorization vulnerability in the Execute Monitor API of the OpenSearch Alerting plugin. This flaw allows an authenticated user with the alerting_full_access role to perform unauthorized read, modify, or delete operations on arbitrary index data by crafting inline monitor requests with manipulated data source and input index parameters. The vulnerability affects OpenSearch Alerting Plugin versions 2.4.0 through 2.19.5 and 3.0.0 through 3.7.0, and Amazon OpenSearch Service domains running engine versions 2.4 through 3.5. The issue is addressed in OpenSearch Alerting Plugin versions 2.19.6 and 3.8.0, and in Amazon OpenSearch Service software update R20260428-P3. AWS advises upgrading to these fixed versions or applying the service software update. As a temporary mitigation, restricting the alerting_full_access role to trusted administrative users can reduce risk.
Potential Impact
An authenticated user with the alerting_full_access role can exploit this vulnerability to read, modify, or delete arbitrary index data in the OpenSearch cluster. This could lead to unauthorized data exposure, data tampering, or data loss within affected OpenSearch environments. The impact is limited to users who already have the alerting_full_access role but can be significant depending on the sensitivity of the indexed data.
Mitigation Recommendations
For self-managed OpenSearch Alerting Plugin deployments, upgrade to version 2.19.6, 3.8.0, or later to apply the official fix. For Amazon OpenSearch Service, apply the service software update R20260428-P3 via the AWS console or allow automatic updates to apply the patch during the next maintenance window. If immediate upgrade or patching is not feasible, restrict the alerting_full_access role to only trusted administrative users to minimize exposure to this vulnerability.
Technical Details
- Classification
- {"confidence":0.88,"severitySource":"default","classifier":"rss-v2"}
- Article Source
- {"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-078-aws/","fetched":true,"fetchedAt":"2026-08-12T18:53:49.250Z","wordCount":280}
Threat ID: 6a7cc13dbf8831d539fc7437
Added to database: 08/12/2026, 18:53:49 UTC
Last enriched: 08/12/2026, 18:54:02 UTC
Last updated: 08/12/2026, 19:46:27 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.