CVE-2026-18952: Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics Plugin
Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18952?
The severity of CVE-2026-18952 is rated high with a score of 8.1.
How do I fix CVE-2026-18952?
To fix CVE-2026-18952, ensure that proper input validation is implemented in the threat intelligence feed parser.
What vulnerabilities does CVE-2026-18952 address?
CVE-2026-18952 addresses issues related to server-side request forgery (SSRF) and insufficient input validation.
What are the potential impacts of CVE-2026-18952?
CVE-2026-18952 may allow an authenticated remote user to read local files through server-side request forgery.
Which software is affected by CVE-2026-18952?
The impacted software is the OpenSearch Security Analytics plugin.