CVE-2026-77811: Stored Cross-Site Scripting via Integration Template Asset in OpenSearch Dashboards
Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenticated user with write permissions to OpenSearch Dashboards saved objects to execute arbitrary JavaScript in the context of other users' browser sessions by uploading a saved asset with arbitrary web content.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must be authenticated and have write permissions for OpenSearch Dashboards saved objects. Exploitation also requires another user to interact with the uploaded malicious saved asset.
What is the impact on a user who opens the malicious asset?
Arbitrary JavaScript can run in that user's OpenSearch Dashboards browser session. The vulnerability is scoped to the dashboards-observability plugin and affects integration template assets that can contain arbitrary web content.
Which releases should be reviewed for remediation?
The provided references include OpenSearch release artifact pages for versions 3.4.0 and 2.19.0, as well as an AWS security bulletin. Review those sources to determine the applicable fixed release or service guidance for the deployed environment.