CVE-2026-64686: OpenSearch Dashboards: SSRF in fetchDataSourceMetaData — missing endpoint validation
OpenSearch Dashboards is an open-source data visualization tool designed to work with OpenSearch. From versions 2.14.0 to before 2.19.6, and 3.0.0 to before 3.7.0, a Server-Side Request Forgery (SSRF) vulnerability in OpenSearch Dashboards exists in the fetchDataSourceMetaData route. The sibling testconnection route validates incoming endpoint URLs via isValidURL() against configured endpointDeniedIPs and endpointAllowlistedSuffixes lists, but fetchDataSourceMetaData accepts the same input shape without performing this validation. An authenticated user can supply an internal or loopback endpoint to probe internal network resources. This issue has been patched in versions 2.19.6 and 3.7.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenSearch Dashboardsto a version that resolves this vulnerability.Fixed in 2.19.6 - Upgrade
Upgrade
OpenSearch Dashboardsto a version that resolves this vulnerability.Fixed in 3.7.0
Event History
Frequently Asked Questions
Which deployments are affected?
OpenSearch Dashboards versions 2.14.0 through 2.19.5 and 3.0.0 through 3.6.0 are affected. The issue is fixed in 2.19.6 and 3.7.0.
What does an attacker need to exploit this issue?
An attacker needs an authenticated OpenSearch Dashboards account. They can submit an internal or loopback endpoint through the fetchDataSourceMetaData route to probe resources reachable from the Dashboards server.
Do configured endpoint deny and allow lists protect this route?
No. Although the sibling test_connection route validates endpoints against endpointDeniedIPs and endpointAllowlistedSuffixes, fetchDataSourceMetaData did not perform that validation.
How can exposure be reduced if an upgrade cannot happen immediately?
Restrict access to authenticated OpenSearch Dashboards users and limit the network locations reachable by the Dashboards server. The vulnerable route can otherwise be used to probe internal or loopback endpoints.