CVE-2026-19311

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-19311
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19311.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-19311
Aliases
  • GHSA-xxpg-q3wh-685q
Published
2026-08-12T18:34:02Z
Modified
2026-08-15T11:30:59Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Missing Authorization in Execute Monitor API in OpenSearch Alerting Plugin
Details

Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters.

Database specific 
{
    "cna_assigner": "AMZN",
    "cwe_ids": [
        "CWE-475"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19311.json"
}
References

Affected packages

Git / github.com/opensearch-project/alerting

Affected ranges

Type
GIT
Repo
https://github.com/opensearch-project/alerting
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
29907a3d846f08576c0f4eaad885c4ddc2dcc715
Introduced
a4a5856c2d3e4c730fcc61438c044e2cbd85f507
Last Affected
f205b0e94b13e710b3dc66c249d4bdd9cfb62d4c
Introduced
4c745fbf2088625b0d1aa9fef38812ff7c0bd80f
Last Affected
48f300244352327de98d8f23065ab1d043cacfb0
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "2.4"
        },
        {
            "last_affected": "3.5"
        },
        {
            "introduced": "2.4.0"
        },
        {
            "last_affected": "2.19.5"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "last_affected": "3.7.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*
0.9.0.0
1.*
1.0.0-beta1
1.0.0.0-rc1
2.*
2.1.0.0
2.19.0.0
2.19.1.0
2.19.2.0
2.19.3.0
2.19.4.0
2.19.5.0
3.*
3.0.0.0-alpha1
3.0.0.0-beta1
3.2.0.0
3.5.0.0
3.7.0.0
v0.*
v0.7.0.0
v0.8.0.0
v1.*
v1.1.0.0
v1.10.0.0
v1.10.0.1
v1.10.1.0
v1.10.1.1
v1.10.1.2
v1.11.0.0
v1.11.0.1
v1.12.0.0
v1.12.0.1
v1.12.0.2
v1.13.1.0
v1.2.0.0
v1.6.0.0
v1.7.0.0
v1.8.0.0
v1.9.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19311.json"