CVE-2026-19311: Missing Authorization in Execute Monitor API in OpenSearch Alerting Plugin
Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19311?
The severity of CVE-2026-19311 is rated as high with a score of 8.1.
What does CVE-2026-19311 affect?
CVE-2026-19311 affects the Execute Monitor API in the Amazon OpenSearch Alerting plugin.
How do I fix CVE-2026-19311?
To fix CVE-2026-19311, ensure proper authorization controls are implemented for the Execute Monitor API.
What could happen if CVE-2026-19311 is exploited?
If CVE-2026-19311 is exploited, an authenticated user may read, modify, or delete index data in an unintended manner.
Who is impacted by CVE-2026-19311?
Authenticated remote users of the Amazon OpenSearch Alerting plugin could be impacted by CVE-2026-19311.