CVE-2026-18952

No fix known EPSS <1%CVSS 8.1

Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read local files via a crafted URL parameter to the threat intel source configuration endpoint.

Published 2026-08-12 · CVE record · OSV

Products: AWS Opensearch, Github Opensearch