CVE-2026-64686 · Package
NO FIX YET · SEE WHAT TO DO
OpenSearch Dashboards has a server-side request forgery flaw in its fetchDataSourceMetaData route, which skips the URL checks the sibling test_connection route applies. An authenticated user can make the server contact internal or loopback addresses to probe internal resources.
first public Jul 2, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Deployments running OpenSearch Dashboards 2.14.0 to before 2.19.6 or 3.0.0 to before 3.7.0 where users hold accounts. The flaw is in the fetchDataSourceMetaData route, so it matters where data sources are used. Instances without authenticated users, or already on the fixed versions, are not exposed.
Not affected if no-authenticated-users, patched-version
Who cares data-sources, opensearch-dashboards, self-hosted
opensearch-dashboards --version or the package manifest; affected are 2.14.0 up to but not including 2.19.6, and 3.0.0 up to but not including 3.7.0.2.19.63.7.0OpenSearch Dashboards is an open-source data visualization tool designed to work with OpenSearch. From versions 2.14.0 to before 2.19.6, and 3.0.0 to before 3.7.0, a Server-Side Request Forgery (SSRF) vulnerability in OpenSearch Dashboards exists in the fetchDataSourceMetaData route. The sibling test_connection route validates incoming endpoint URLs via isValidURL() against configured endpointDeniedIPs and endpointAllowlistedSuffixes lists, but fetchDataSourceMetaData accepts the same input shape without performing this validation. An authenticated user can supply an internal or loopback endpoint to probe internal network resources. This issue has been patched in versions 2.19.6 and 3.7.0.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.