{"id":"CVE-2026-64686","kind":"vulnerability","aliases":["CVE-2026-64686"],"related":[],"title":"OpenSearch Dashboards: authenticated users can probe internal network via data source route","description":"OpenSearch Dashboards is an open-source data visualization tool designed to work with OpenSearch. From versions 2.14.0 to before 2.19.6, and 3.0.0 to before 3.7.0, a Server-Side Request Forgery (SSRF) vulnerability in OpenSearch Dashboards exists in the fetchDataSourceMetaData route. The sibling test_connection route validates incoming endpoint URLs via isValidURL() against configured endpointDeniedIPs and endpointAllowlistedSuffixes lists, but fetchDataSourceMetaData accepts the same input shape without performing this validation. An authenticated user can supply an internal or loopback endpoint to probe internal network resources. This issue has been patched in versions 2.19.6 and 3.7.0.","summary":"OpenSearch Dashboards has a server-side request forgery flaw in its fetchDataSourceMetaData route, which skips the URL checks the sibling test_connection route applies. An authenticated user can make the server contact internal or loopback addresses to probe internal resources.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["data-sources","opensearch-dashboards","package","self-hosted"],"not_affected_if":["no-authenticated-users","patched-version"],"how_to_check":"- Check the OpenSearch Dashboards version with `opensearch-dashboards --version` or the package manifest; affected are 2.14.0 up to but not including `2.19.6`, and 3.0.0 up to but not including `3.7.0`.\n- Check whether data source endpoints are configured in the Dashboards settings.","fix":"- OpenSearch Dashboards 2.x: upgrade to `2.19.6`\n- OpenSearch Dashboards 3.x: upgrade to `3.7.0`","status":"open","published_at":"2026-11-11T05:19:52+00:00","first_seen_at":"2026-11-11T05:25:40+00:00","triaged_at":"2026-11-11T05:26:46+00:00","updated_at":"2026-11-11T05:26:46+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T05:26:46Z","model":"claude-haiku-5-5","output":{"fix":"- OpenSearch Dashboards 2.x: upgrade to `2.19.6`\n- OpenSearch Dashboards 3.x: upgrade to `3.7.0`","reach":"network","title":"OpenSearch Dashboards: authenticated users can probe internal network via data source route","impact":"medium","summary":"OpenSearch Dashboards has a server-side request forgery flaw in its fetchDataSourceMetaData route, which skips the URL checks the sibling test_connection route applies. An authenticated user can make the server contact internal or loopback addresses to probe internal resources.","audience":"businesses","category":"package","nicknames":[],"who_cares":["opensearch-dashboards","self-hosted","data-sources"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user reaches internal and loopback network services","analyst_note":"","how_to_check":"- Check the OpenSearch Dashboards version with `opensearch-dashboards --version` or the package manifest; affected are 2.14.0 up to but not including `2.19.6`, and 3.0.0 up to but not including `3.7.0`.\n- Check whether data source endpoints are configured in the Dashboards settings.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patched-version","no-authenticated-users"],"who_is_affected":"Deployments running OpenSearch Dashboards 2.14.0 to before 2.19.6 or 3.0.0 to before 3.7.0 where users hold accounts. The flaw is in the fetchDataSourceMetaData route, so it matters where data sources are used. Instances without authenticated users, or already on the fixed versions, are not exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00079,"input_tokens":4756,"output_tokens":629,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-64686':15A,18A '2.14.0':87C '2.19.6':90C,162C '3.0.0':92C '3.7.0':95C,164C 'accept':131C 'address':65B 'appli':53B 'authent':3A,55B,141C 'check':47B 'configur':124C 'connect':51B,115C 'contact':61B 'cve':13A,16A 'dashboard':2A,24B,30B,71C,106C 'data':10A,20B,77C 'data-sourc':19B 'design':80C 'endpoint':119C,149C 'endpointallowlistedsuffix':127C 'endpointdeniedip':125C 'exist':107C 'fetchdatasourcemetadata':41B,110C,130C 'flaw':38B 'forgeri':37B,101C 'host':28B 'incom':118C 'input':134C 'intern':7A,62B,68B,146C,152C 'issu':156C 'isvalidurl':122C 'list':128C 'loopback':64B,148C 'make':58B 'network':8A,153C 'open':75C 'open-sourc':74C 'opensearch':1A,23B,29B,70C,84C,105C 'opensearch-dashboard':22B 'packag':25B 'patch':159C 'perform':137C 'probe':6A,67B,151C 'request':36B,100C 'resourc':69B,154C 'rout':12A,42B,52B,111C,116C 'self':27B 'self-host':26B 'server':34B,60B,98C 'server-sid':33B,97C 'shape':135C 'sibl':49B,113C 'side':35B,99C 'skip':44B 'sourc':11A,21B,76C 'ssrf':102C 'suppli':144C 'test':50B,114C 'tool':79C 'url':46B,120C 'user':4A,56B,142C 'valid':117C,139C 'version':86C,161C 'via':9A,121C 'visual':78C 'vulner':103C 'without':136C 'work':82C","nicknames":[],"mitigations":[],"who_affected":"Deployments running OpenSearch Dashboards 2.14.0 to before 2.19.6 or 3.0.0 to before 3.7.0 where users hold accounts. The flaw is in the fetchDataSourceMetaData route, so it matters where data sources are used. Instances without authenticated users, or already on the fixed versions, are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["datasources","medium","opensearchdashboards","package","selfhosted"],"campaign_type":null,"search_a":"'-2026':14A,17A '-64686':15A,18A 'authent':3A 'cve':13A,16A 'dashboard':2A 'data':10A 'intern':7A 'network':8A 'opensearch':1A 'probe':6A 'rout':12A 'sourc':11A 'user':4A 'via':9A","search_b":"'address':65B 'appli':53B 'authent':55B 'check':47B 'connect':51B 'contact':61B 'dashboard':24B,30B 'data':20B 'data-sourc':19B 'fetchdatasourcemetadata':41B 'flaw':38B 'forgeri':37B 'host':28B 'intern':62B,68B 'loopback':64B 'make':58B 'opensearch':23B,29B 'opensearch-dashboard':22B 'packag':25B 'probe':67B 'request':36B 'resourc':69B 'rout':42B,52B 'self':27B 'self-host':26B 'server':34B,60B 'server-sid':33B 'sibl':49B 'side':35B 'skip':44B 'sourc':21B 'test':50B 'url':46B 'user':56B","search_c":"'2.14.0':87C '2.19.6':90C,162C '3.0.0':92C '3.7.0':95C,164C 'accept':131C 'authent':141C 'configur':124C 'connect':115C 'dashboard':71C,106C 'data':77C 'design':80C 'endpoint':119C,149C 'endpointallowlistedsuffix':127C 'endpointdeniedip':125C 'exist':107C 'fetchdatasourcemetadata':110C,130C 'forgeri':101C 'incom':118C 'input':134C 'intern':146C,152C 'issu':156C 'isvalidurl':122C 'list':128C 'loopback':148C 'network':153C 'open':75C 'open-sourc':74C 'opensearch':70C,84C,105C 'patch':159C 'perform':137C 'probe':151C 'request':100C 'resourc':154C 'rout':111C,116C 'server':98C 'server-sid':97C 'shape':135C 'sibl':113C 'side':99C 'sourc':76C 'ssrf':102C 'suppli':144C 'test':114C 'tool':79C 'url':120C 'user':142C 'valid':117C,139C 'version':86C,161C 'via':121C 'visual':78C 'vulner':103C 'without':136C 'work':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-02T20:32:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-64686","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64686","severity":null,"published_at":"2026-11-11T05:19:52+00:00","modified_at":"2026-11-11T05:19:52+00:00","first_seen_at":"2026-11-11T05:25:40+00:00","fetched_at":"2026-11-11T05:25:40+00:00","note":null}],"documents":[{"id":122887,"url":"https://github.com/opensearch-project/OpenSearch-Dashboards/releases/tag/2.19.6","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":122888,"url":"https://github.com/opensearch-project/OpenSearch-Dashboards/releases/tag/3.7.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":122889,"url":"https://github.com/opensearch-project/OpenSearch-Dashboards/security/advisories/GHSA-6qp6-3675-ffr3","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-02T20:32:24+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}