Live › vulnerability › CVE-2026-84942
Go to dashboardA user with dashboard write permission can save a crafted Vega visualization that runs arbitrary JavaScript when other users open it. The script executes in the victim's browser session, so it can act as that user inside OpenSearch Dashboards.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 18:56 UTC, 0h before NVD. All times on this page are UTC.
Self-managed OpenSearch Dashboards instances in the affected version ranges are exposed when users with dashboard write permissions can save visualizations that other users open. Amazon OpenSearch Service domains on the listed versions are also affected until the service software update is applied. Amazon OpenSearch Serverless is not affected, and deployments where only trusted users can write saved objects carry much less risk.
No product ranges from the sources yet.
opensearch-dashboards --version or the package manifest; affected open-source lines run from 2.0.0 through 3.5.02.19.5 or 3.6.0 or later, and patch any forked or derivative codeEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-84942 - Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards
Bulletin ID: 2026-102-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/08/2026 12:30 PM PDT
Description:
A stored cross-site scripting (XSS) issue in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization.
Affedted products & versions:
Resolution:
For OpenSearch (open-source), this issue has been addressed in OpenSearch Dashboards 2.19.5 and 3.6.0. We recommend upgrading to one of these versions or later, which includes additional hardening of Vega expression validation, and ensuring any forked or derivative code is patched to incorporate the new fixes.
For Amazon OpenSearch Service (managed), this issue has been addressed and patched in all affected versions. We recommend that customers update their domains to the latest service software version as soon as possible. No engine version upgrade is required. You can apply the update from the console by selecting your domain, choosing Actions, Service Software Version, then clicking Update. Domains with automatic software updates enabled receive this update during their next off-peak window with no action required. For full details, see Service software updates in Amazon OpenSearch Service.
Workarounds:
Because this issue requires dashboard/visualization write permissions to reproduce, restrict write access to the visualization and saved-object APIs to trusted users only. Optionally, disable the Vega visualization type. These measures reduce impact until the update is applied.
References:
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("CVE-2026-84942")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.