CVE-2026-18420 — RCE via Prototype Pollution in OpenSearch Dashboards
Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server vi…
Published: 2026-08-20 · CVSS: 8.7 · CVSS 4.0
Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enables remote code execution. To remediate this issue, users should upgrade to OpenSearch Dashboards 3.8 or later.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7