CVE-2026-18952

Name of the Vulnerable Software and Affected Versions OpenSearch Security Analytics plugin (affected versions not specified)

Description Missing input validation in the threat intelligence feed parser allows an authenticated remote user to perform server-side request forgery (SSRF)—a technique where an attacker induces a server to make requests to an unintended location—and read local files. This is achieved by using a crafted URL parameter sent to the threat intel source configuration endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.