CVE-2026-77811 - Stored Cross-Site Scripting via Integration Template Asset in OpenSearch Dashboards
CVE-2026-77811 is a stored cross-site scripting (XSS) vulnerability in the dashboards-observability plugin of OpenSearch Dashboards. It allows a remote authenticated user with write permissions to upload a custom integration containing arbitrary JavaScript via the integrations static file endpoint. When another user accesses this endpoint, the malicious script executes in their browser, potentially performing actions with their privileges. The issue affects OpenSearch Dashboards versions before 3.4 and before 2.19.6, and Amazon OpenSearch Service versions before 3.3. Fixes have been released for all affected versions.
AI Analysis
Technical Summary
This vulnerability arises from improper input validation in the integrations static file endpoint of the dashboards-observability plugin in OpenSearch Dashboards. An authenticated actor with write access to saved objects can upload a crafted integration containing arbitrary JavaScript. When other users access the static file endpoint, the script executes in their browser context, enabling actions on their behalf, including API calls to OpenSearch with their privileges. The vulnerability affects open-source OpenSearch Dashboards versions prior to 3.4 and 2.19.6, and Amazon OpenSearch Service managed versions prior to 3.3. The issue has been addressed in OpenSearch Dashboards versions 3.4 and 2.19.6 and all affected Amazon OpenSearch Service versions via service software updates.
Potential Impact
Exploitation of this vulnerability allows an authenticated user with write permissions to inject malicious JavaScript that executes in other users' browser sessions. This can lead to unauthorized actions performed with the victim's privileges, including making API calls to OpenSearch. The impact includes potential unauthorized data access or manipulation within OpenSearch Dashboards environments where the vulnerability is present.
Mitigation Recommendations
A fix is available and has been applied in OpenSearch Dashboards dashboards-observability plugin versions 3.4 and 2.19.6, and all affected Amazon OpenSearch Service managed versions via service software updates. Users should upgrade to these fixed versions or apply the service software update for managed domains. For Amazon OpenSearch Service, no engine version upgrade is required; updates can be applied via the AWS console or occur automatically if automatic updates are enabled. As a workaround, restrict write access to Dashboards saved objects to trusted users and avoid direct browser access to assets from the integrations static file API outside the normal web UI.
CVE-2026-77811 - Stored Cross-Site Scripting via Integration Template Asset in OpenSearch Dashboards
Description
CVE-2026-77811 is a stored cross-site scripting (XSS) vulnerability in the dashboards-observability plugin of OpenSearch Dashboards. It allows a remote authenticated user with write permissions to upload a custom integration containing arbitrary JavaScript via the integrations static file endpoint. When another user accesses this endpoint, the malicious script executes in their browser, potentially performing actions with their privileges. The issue affects OpenSearch Dashboards versions before 3.4 and before 2.19.6, and Amazon OpenSearch Service versions before 3.3. Fixes have been released for all affected versions.
Affected software
pkg:github/opensearch-project/opensearch-dashboardspkg:github/amazon/opensearch-serviceRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability arises from improper input validation in the integrations static file endpoint of the dashboards-observability plugin in OpenSearch Dashboards. An authenticated actor with write access to saved objects can upload a crafted integration containing arbitrary JavaScript. When other users access the static file endpoint, the script executes in their browser context, enabling actions on their behalf, including API calls to OpenSearch with their privileges. The vulnerability affects open-source OpenSearch Dashboards versions prior to 3.4 and 2.19.6, and Amazon OpenSearch Service managed versions prior to 3.3. The issue has been addressed in OpenSearch Dashboards versions 3.4 and 2.19.6 and all affected Amazon OpenSearch Service versions via service software updates.
Potential Impact
Exploitation of this vulnerability allows an authenticated user with write permissions to inject malicious JavaScript that executes in other users' browser sessions. This can lead to unauthorized actions performed with the victim's privileges, including making API calls to OpenSearch. The impact includes potential unauthorized data access or manipulation within OpenSearch Dashboards environments where the vulnerability is present.
Mitigation Recommendations
A fix is available and has been applied in OpenSearch Dashboards dashboards-observability plugin versions 3.4 and 2.19.6, and all affected Amazon OpenSearch Service managed versions via service software updates. Users should upgrade to these fixed versions or apply the service software update for managed domains. For Amazon OpenSearch Service, no engine version upgrade is required; updates can be applied via the AWS console or occur automatically if automatic updates are enabled. As a workaround, restrict write access to Dashboards saved objects to trusted users and avoid direct browser access to assets from the integrations static file API outside the normal web UI.
Technical Details
- Classification
- {"confidence":0.95,"severitySource":"heuristic","classifier":"rss-v2"}
- Article Source
- {"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-088-aws/","fetched":true,"fetchedAt":"2026-08-21T20:20:41.564Z","wordCount":380}
Threat ID: 6a88b319acd9273b49ad699d
Added to database: 08/21/2026, 20:20:41 UTC
Last enriched: 08/21/2026, 20:20:49 UTC
Last updated: 08/21/2026, 20:37:42 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.