CVE-2026-18420

Name of the Vulnerable Software and Affected Versions OpenSearch Dashboards versions prior to 3.8

Description Improper input validation in the Time Series Visual Builder (TSVB) plugin allows an authenticated remote user to execute arbitrary code on the server. This is achieved by sending a crafted JSON payload to the metrics visualization API endpoint. The issue is a form of prototype pollution, which occurs when an attacker manipulates the prototype of a JavaScript object to inject properties that can lead to remote code execution.

Recommendations Upgrade to OpenSearch Dashboards 3.8 or later.