CVE-2026-18952

HIGH

CVE: CVE-2026-18952 - Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated ...Sign in to save

CVSS

8.1

CVSS v3.1

EPSS

N/A

Exploit Prediction Score

Published

August 12, 2026

Exploitability

No EPSS data available

Description

Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint.

Weaknesses

CWE-918

Affected Packages

No package data available.

Aliases

CVE-2026-18952

Related references

Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).

https://aws.amazon.com/security/security-bulletins/2026-079-aws/
https://docs.aws.amazon.com/opensearch-service/latest/developerguide/service-software.html