CVE-2026-18952

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-18952
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18952.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-18952
Aliases
  • GHSA-w946-8jxc-6v3m
Published
2026-08-12T18:42:38Z
Modified
2026-10-28T02:30:28Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics Plugin
Details

Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint.

Database specific 
{
    "cna_assigner": "AMZN",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18952.json"
}
References

Affected packages

Git / github.com/opensearch-project/security-analytics

Affected ranges

Type
GIT
Repo
https://github.com/opensearch-project/security-analytics
Events
Introduced
c0de31a0e99bfc3ab8201706e4d8d74db8a0f4e6
Fixed
1435464d84e284d514817616c3b957228f1c5518
Fixed
c60816f3eab8d2ba1e505e232cbe53da85634867
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "2.15.0"
                },
                {
                    "fixed": "3.5.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "introduced": "2.15.0"
                },
                {
                    "fixed": "3.7.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18952.json"