CVE-2026-77811 - Stored Cross-Site Scripting via Integration Template Asset in OpenSearch Dashboards
Description
CVE-2026-77811 is a stored cross-site scripting (XSS) vulnerability in the dashboards-observability plugin of OpenSearch Dashboards. It allows a remote authenticated user with write permissions to upload a custom integration containing arbitrary JavaScript. When other users access the affected static file endpoint, the malicious script executes in their browser, potentially performing actions on their behalf with their privileges. This affects self-managed OpenSearch Dashboards versions before 3.4 and 2.19.6, and Amazon OpenSearch Service versions before 3.3. The issue has been fixed in OpenSearch Dashboards versions 3.4 and 2.19.6 and all affected Amazon OpenSearch Service versions via service software updates. Users are advised to upgrade to these fixed versions or apply the managed service update. Workarounds include restricting write access and avoiding direct access to the vulnerable endpoint.
Affected software
pkg:github/opensearch-project/opensearch-dashboardspkg:github/amazon/opensearch-serviceRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-77811 is a stored cross-site scripting vulnerability in the dashboards-observability plugin of OpenSearch Dashboards. The vulnerability arises from improper input validation in the integrations static file endpoint, allowing a remote authenticated actor with write permissions to upload a custom integration containing arbitrary JavaScript code. When another user accesses this static file endpoint, the malicious script executes within their browser session, enabling actions on their behalf, including making API calls to OpenSearch with their privileges. This affects self-managed OpenSearch Dashboards versions prior to 3.4 and 2.19.6, and Amazon OpenSearch Service managed versions prior to 3.3. The vulnerability has been addressed in OpenSearch Dashboards versions 3.4 and 2.19.6 and all affected Amazon OpenSearch Service versions via service software updates. The vendor recommends upgrading to these versions or applying the managed service update. Workarounds include restricting write permissions to trusted users and avoiding direct browser access to the vulnerable static file endpoint.
Potential Impact
An authenticated user with write permissions can inject arbitrary JavaScript into OpenSearch Dashboards via the integrations static file endpoint. This script executes in the browsers of other users who access the endpoint, potentially allowing the attacker to perform actions with the victim's privileges, including making API calls to OpenSearch. This could lead to unauthorized actions within the OpenSearch environment under the victim's context.
Mitigation Recommendations
This vulnerability has been fixed in OpenSearch Dashboards dashboards-observability plugin versions 3.4 and 2.19.6 and all affected Amazon OpenSearch Service managed versions via service software updates. Users should upgrade to these fixed versions or apply the managed service update as soon as possible. For Amazon OpenSearch Service, no engine version upgrade is required; the update can be applied via the AWS console or will be applied automatically if automatic updates are enabled. As a workaround, restrict write access for Dashboards saved objects to trusted users only and avoid directly accessing assets from the integrations static file API in a browser or outside the normal web UI.
Technical Details
- Classification
- {"confidence":0.95,"severitySource":"heuristic","classifier":"rss-v2"}
- Article Source
- {"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-088-aws/","fetched":true,"fetchedAt":"2026-08-21T20:20:41.564Z","wordCount":380}
Threat ID: 6a88b319acd9273b49ad699d
Added to database: 08/21/2026, 20:20:41 UTC
Last enriched: 09/10/2026, 17:21:04 UTC
Last updated: 10/05/2026, 18:48:22 UTC
Views: 94
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.