---
id: "CVE-2026-64686"
page: "https://infrastack.ai/live/CVE-2026-64686"
kind: "vulnerability"
aliases: ["CVE-2026-64686"]
title: "OpenSearch Dashboards: authenticated users can probe internal network via data source route"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["data-sources", "opensearch-dashboards", "package", "self-hosted"]
not_affected_if: ["no-authenticated-users", "patched-version"]
published_at: "2026-11-11T05:19:52+00:00"
first_seen_at: "2026-11-11T05:25:40+00:00"
updated_at: "2026-11-11T05:26:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64686", "first_seen_at": "2026-11-11T05:25:40+00:00"}]
exploit_sources: []
---

# OpenSearch Dashboards: authenticated users can probe internal network via data source route

Link for people: https://infrastack.ai/live/CVE-2026-64686 (this .md is for agents)

OpenSearch Dashboards has a server-side request forgery flaw in its fetchDataSourceMetaData route, which skips the URL checks the sibling test_connection route applies. An authenticated user can make the server contact internal or loopback addresses to probe internal resources.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the OpenSearch Dashboards version with `opensearch-dashboards --version` or the package manifest; affected are 2.14.0 up to but not including `2.19.6`, and 3.0.0 up to but not including `3.7.0`.
- Check whether data source endpoints are configured in the Dashboards settings.

## Fix

- OpenSearch Dashboards 2.x: upgrade to `2.19.6`
- OpenSearch Dashboards 3.x: upgrade to `3.7.0`

## Timeline

- 2026-11-11T05:25:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-64686

## Documents

- [advisory] Vendor advisory: github.com https://github.com/opensearch-project/OpenSearch-Dashboards/security/advisories/GHSA-6qp6-3675-ffr3
- [fix] Release notes: github.com https://github.com/opensearch-project/OpenSearch-Dashboards/releases/tag/2.19.6
- [fix] Release notes: github.com https://github.com/opensearch-project/OpenSearch-Dashboards/releases/tag/3.7.0

## From the sources

OpenSearch Dashboards is an open-source data visualization tool designed to work with OpenSearch. From versions 2.14.0 to before 2.19.6, and 3.0.0 to before 3.7.0, a Server-Side Request Forgery (SSRF) vulnerability in OpenSearch Dashboards exists in the fetchDataSourceMetaData route. The sibling test_connection route validates incoming endpoint URLs via isValidURL() against configured endpointDeniedIPs and endpointAllowlistedSuffixes lists, but fetchDataSourceMetaData accepts the same input shape without performing this validation. An authenticated user can supply an internal or loopback endpoint to probe internal network resources. This issue has been patched in versions 2.19.6 and 3.7.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_