CVE-2026-18420: OpenSearch Dashboards TSVB Prototype Pollution RCE

TL;DR: Improper input validation in the Time Series Visual Builder (TSVB) plugin lets an authenticated remote user with standard data access (no admin) send crafted JSON to the metrics visualization API. That is CWE-1321 prototype pollution, and it becomes RCE in the OpenSearch Dashboards Node.js server process. GitHub rates GHSA-xmqx-xq2p-8jq2 High, CVSS 3.1 8.8 (PR:L). The GHSA landed 2026-08-11. CVE-2026-18420 is the 2026-08-20 assignment. Affected: OpenSearch Dashboards OSS and AWS Managed >=3.0.0 <3.8.0. Fixed in 3.8.0. Not unauthenticated. Not in CISA KEV.

What happened

OpenSearch Dashboards is the visualization UI for OpenSearch. TSVB is the Time Series Visual Builder plugin. Before 3.8.0, TSVB did not validate input on the metrics visualization API tightly enough. An authenticated caller with standard data access can POST crafted JSON and pollute Object.prototype. In the Dashboards Node.js process that pollution is not a display bug. It is remote code execution.

GitHub published GHSA-xmqx-xq2p-8jq2 on 2026-08-11 and classified it CWE-1321. The GHSA page still listed no CVE id when fetched. CVE-2026-18420 was assigned on 2026-08-20. AWS published bulletin 2026-085-AWS the same day, 2026-08-20 13:30 PDT, covering both self-managed OSS Dashboards and Amazon OpenSearch Service. This is not a new patch. 3.8.0 is the fix. The CVE is the later identifier.

Admin is not required. Standard data access is enough. The CVSS vector is PR:L. An unauthenticated internet client is not in scope.

Affected versions

• Package: OpenSearch Dashboards (OSS, self-managed) and Amazon OpenSearch Service (AWS Managed)
• Affected (HOL evidence pack): OpenSearch/OpenSearch Dashboards >=3.0.0 <3.8.0 (fixed in 3.8.0). AWS/Amazon OpenSearch Service >=3.0.0 <3.8.0 (fixed in 3.8.0).
• Fixed: 3.8.0. OpenSearch docs list 3.8.0 as released 2026-08-04. Official bundles are on the OpenSearch artifacts page. The GitHub releases/tag/3.8.0 URL returned 404 when fetched 2026-08-20, so this article does not cite that tag.
• CWE: CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes / Prototype Pollution). GHSA and the HOL pack both list CWE-1321.
• CVSS: GitHub GHSA-xmqx-xq2p-8jq2, High, CVSS 3.1 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). HOL Guard's evidence pack still has cvssScore: null. The 8.8 figure comes from GHSA, not from an NVD analysis score in the HOL pack. Not listed in CISA KEV. knownExploited is false in the HOL pack.
• Preconditions: authenticated remote user with standard data access. TSVB metrics visualization API reachable. Not unauthenticated. Not an admin-only bug.

How to fix

Upgrade self-managed OpenSearch Dashboards to 3.8.0 or later:

docker pull opensearchproject/opensearch-dashboards:3.8.0

If you install from the official Debian, RPM, or tarball bundles, take 3.8.0 from the OpenSearch artifacts page. The running version must be 3.8.0 or newer. Do not stay on any 3.x in >=3.0.0 and <3.8.0.

AWS Managed (Amazon OpenSearch Service): apply the latest service software update. The OpenSearch Service console Notifications panel indicates when an update is available for your domain. AWS documents the request as:

aws opensearch start-service-software-update \
  --domain-name YOUR_DOMAIN \
  --schedule-at NOW

Until you upgrade, disable TSVB. That is the vendor workaround, not a patch. GHSA-xmqx-xq2p-8jq2 and AWS bulletin 2026-085-AWS both say to disable TSVB until Dashboards is on a fixed version.

Technical details

TSVB accepts JSON on the metrics visualization API. The plugin did not keep attacker-controlled keys off the prototype chain. That is CWE-1321. Once Object.prototype is polluted, later code in the same Node.js process can pick up attacker-controlled properties and turn them into execution. The GHSA impact list is: read environment variables, configuration, and credentials; filesystem read, write, and execute; arbitrary commands; possible lateral movement if the OSD process can reach other services.

PR:L on the CVSS 3.1 vector is the standard data-access gate. A logged-in user with ordinary data permissions is enough. An unauthenticated client is not.

The GHSA published 2026-08-11. AWS bulletin 2026-085-AWS published 2026-08-20 13:30 PDT. CVE-2026-18420 is the later assignment. HOL Guard first saw the CVE record at 2026-08-20T21:00:21.765Z, after the CVE List publishedAt of 2026-08-20T20:40:40.709Z.

HOL Guard's evidence pack still has cvssScore: null and editorialStatus: not_started. The 8.8 High score above comes from GHSA-xmqx-xq2p-8jq2, not from an NVD analysis score in the HOL pack.

This article is the operator write-up: what broke, who is affected, and how to fix it. The HOL Guard evidence page is the source record for CVE-2026-18420.

References

• GHSA-xmqx-xq2p-8jq2
• AWS security bulletin 2026-085-AWS
• CVE-2026-18420 CVE List record
• OpenSearch artifacts, including Dashboards 3.8.0
• OpenSearch version history (3.8.0, 2026-08-04)
• Amazon OpenSearch Service software updates