{"id":"CVE-2026-84942","kind":"vulnerability","aliases":["CVE-2026-84942"],"related":[],"title":"OpenSearch Dashboards: saved Vega visualizations run attacker JavaScript in viewers' browsers","description":"CVE-2026-84942 - Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards\n\n### CVE-2026-84942 - Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards\n\nBulletin ID: 2026-102-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/08/2026 12:30 PM PDT\n\nDescription:\n\nA stored cross-site scripting (XSS) issue in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization.\n\nAffedted products & versions:\n\n- OpenSearch Dashboards (open-source, self-managed) - Affected: v2.0.0, v2.1.0, v2.2.0, v2.3.0, v2.4.0, v2.5.0, v.2.6.0, v2.7.0, v2.8.0, v2.9.0, v2.10.0, v2.11.0, v2.12.0, v2.13.0, v2.14.0, v2.15.0, v2.16.0, v2.17.0, v2.18.0, v2.19.0, v3.0.0, v3.1.0, v3.2.0, v3.3.0, v3.4.0, v3.5.0 - Fixed: v2.19.5 and v3.6.0 \n- Amazon OpenSearch Service (AWS Managed) - Affected: v2.3.0, v2.5.0, v2.7.0, v2.9.0, v2.11.0, v2.13.0, v2.15.0, v2.17.0, v2.19.0, v3.1.0, v3.3.0, v3.5.0 - Fixed: v2.3.0, v2.5.0, v2.7.0, v2.9.0, v2.11.0, v2.13.0, v2.15.0, v2.17.0, v2.19.0 and v3.1.0, v3.3.0, v3.5.0 \n- Amazon OpenSearch Serverless - Not affected\n\nResolution:\n\nFor OpenSearch (open-source), this issue has been addressed in OpenSearch Dashboards 2.19.5 and 3.6.0. We recommend upgrading to one of these versions or later, which includes additional hardening of Vega expression validation, and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nFor Amazon OpenSearch Service (managed), this issue has been addressed and patched in all affected versions. We recommend that customers update their domains to the latest service software version as soon as possible. No engine version upgrade is required. You can apply the update from the console by selecting your domain, choosing Actions, Service Software Version, then clicking Update. Domains with automatic software updates enabled receive this update during their next off-peak window with no action required. For full details, see Service software updates in Amazon OpenSearch Service.\n\nWorkarounds:\n\nBecause this issue requires dashboard/visualization write permissions to reproduce, restrict write access to the visualization and saved-object APIs to trusted users only. Optionally, disable the Vega visualization type. These measures reduce impact until the update is applied.\n\nReferences:\n\n- CVE-2026-84942\n- OpenSearch Dashboards - Update checkForFunctionProperty to handle arrays- #11404\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"A user with dashboard write permission can save a crafted Vega visualization that runs arbitrary JavaScript when other users open it. The script executes in the victim's browser session, so it can act as that user inside OpenSearch Dashboards.","severity":"high","cvss":8.7,"epss":0.00544,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amazon-opensearch-service","aws","lab-disclosure","opensearch","opensearch-dashboards","package","self-hosted"],"not_affected_if":["amazon-opensearch-serverless","no-write-access-to-dashboards","vega-disabled"],"how_to_check":"- Check the installed OpenSearch Dashboards version with `opensearch-dashboards --version` or the package manifest; affected open-source lines run from `2.0.0` through `3.5.0`\n- For Amazon OpenSearch Service, check the domain's service software version in the console under Actions, Service Software Version\n- Confirm whether the Vega visualization type is in use on the instance","fix":"- Open-source OpenSearch Dashboards: upgrade to `2.19.5` or `3.6.0` or later, and patch any forked or derivative code\n- Amazon OpenSearch Service: apply the service software update from the console (Actions, Service Software Version, Update); no engine version upgrade is needed\n- Until patched: restrict dashboard and saved-object write access to trusted users, and optionally disable the Vega visualization type","status":"open","published_at":"2026-09-08T20:18:51+00:00","first_seen_at":"2026-10-24T18:56:54+00:00","triaged_at":"2026-10-25T05:29:35+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T05:29:35Z","model":"claude-haiku-5-5","output":{"fix":"- Open-source OpenSearch Dashboards: upgrade to `2.19.5` or `3.6.0` or later, and patch any forked or derivative code\n- Amazon OpenSearch Service: apply the service software update from the console (Actions, Service Software Version, Update); no engine version upgrade is needed\n- Until patched: restrict dashboard and saved-object write access to trusted users, and optionally disable the Vega visualization type","reach":"internet","title":"OpenSearch Dashboards: saved Vega visualizations run attacker JavaScript in viewers' browsers","impact":"medium","summary":"A user with dashboard write permission can save a crafted Vega visualization that runs arbitrary JavaScript when other users open it. The script executes in the victim's browser session, so it can act as that user inside OpenSearch Dashboards.","category":"package","nicknames":[],"who_cares":["opensearch","opensearch-dashboards","self-hosted","aws","amazon-opensearch-service"],"confidence":0.8,"needs_auth":"yes","worst_case":"Script runs in other users' browser sessions, acting as those users","analyst_note":"","how_to_check":"- Check the installed OpenSearch Dashboards version with `opensearch-dashboards --version` or the package manifest; affected open-source lines run from `2.0.0` through `3.5.0`\n- For Amazon OpenSearch Service, check the domain's service software version in the console under Actions, Service Software Version\n- Confirm whether the Vega visualization type is in use on the instance","needs_analyst":false,"not_affected_if":["amazon-opensearch-serverless","no-write-access-to-dashboards","vega-disabled"],"who_is_affected":"Self-managed OpenSearch Dashboards instances in the affected version ranges are exposed when users with dashboard write permissions can save visualizations that other users open. Amazon OpenSearch Service domains on the listed versions are also affected until the service software update is applied. Amazon OpenSearch Serverless is not affected, and deployments where only trusted users can write saved objects carry much less risk.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000826,"input_tokens":4488,"output_tokens":754,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-102':109C '-2026':13A,16A,75C,91C,430C '-84942':14A,17A,76C,92C,431C '09/08/2026':120C '11404':439C '12':121C '2.19.5':263C '2026':108C '3.6.0':265C '30':122C 'access':400C 'act':67B 'action':350C,375C 'actor':147C 'addit':278C 'address':259C,307C 'affect':181C,217C,248C,312C 'affedt':170C 'allow':143C 'amazon':19B,212C,244C,299C,385C 'amazon-opensearch-servic':18B 'api':408C 'appli':339C,427C 'arbitrari':48B,154C 'array':438C 'attack':7A 'attent':117C 'authent':146C 'automat':359C 'aw':22B,110C,112C,215C 'aws-security@amazon.com':442C 'browser':11A,62B,162C 'bulletin':106C 'bypass':86C,102C 'checkforfunctionproperti':435C 'choos':349C 'click':355C 'code':290C 'concern':448C 'consol':344C 'content':113C 'context':158C 'craft':43B,167C 'cross':79C,95C,129C 'cross-sit':78C,94C,128C 'custom':317C 'cve':12A,15A,74C,90C,429C 'dashboard':2A,29B,37B,73B,89C,105C,142C,149C,174C,262C,433C 'dashboard/visualization':393C 'date':119C 'deriv':289C 'descript':125C 'detail':379C 'disabl':414C 'disclosur':25B 'domain':320C,348C,357C 'email':441C 'enabl':362C 'engin':332C 'ensur':285C 'execut':57B,153C 'express':84C,100C,137C,282C 'fix':208C,230C,297C 'fork':287C 'full':378C 'function':85C,101C,138C 'handl':437C 'harden':279C 'host':33B 'id':107C 'impact':422C 'implement':139C 'import':115C 'includ':277C 'incorpor':294C 'insid':71B 'issu':133C,256C,304C,391C 'javascript':8A,49B,155C 'lab':24B 'lab-disclosur':23B 'later':275C 'latest':323C 'manag':180C,216C,302C 'measur':420C 'new':296C 'next':368C 'object':407C 'off-peak':369C 'one':270C 'open':53B,176C,253C 'open-sourc':175C,252C 'opensearch':1A,20B,26B,28B,72B,88C,104C,141C,173C,213C,245C,251C,261C,300C,386C,432C 'opensearch-dashboard':27B 'option':413C 'packag':30B 'patch':292C,309C 'pdt':124C 'peak':371C 'permiss':39B,151C,395C 'pleas':440C 'pm':123C 'possibl':330C 'product':171C 'public':118C 'question':446C 'receiv':363C 'recommend':267C,315C 'reduc':421C 'refer':428C 'remot':145C 'reproduc':397C 'requir':116C,336C,376C,392C 'resolut':249C 'restrict':398C 'run':6A,47B 'save':3A,41B,165C,406C 'saved-object':405C 'scope':111C 'script':56B,81C,97C,131C 'secur':445C 'see':380C 'select':346C 'self':32B,179C 'self-host':31B 'self-manag':178C 'serverless':246C 'servic':21B,214C,301C,324C,351C,381C,387C 'session':63B,163C 'site':80C,96C,130C 'softwar':325C,352C,360C,382C 'soon':328C 'sourc':177C,254C 'store':77C,93C,127C 'trust':410C 'type':114C,418C 'updat':318C,341C,356C,361C,365C,383C,425C,434C 'upgrad':268C,334C 'user':35B,52B,70B,161C,411C 'v.2.6.0':188C 'v2.0.0':182C 'v2.1.0':183C 'v2.10.0':192C 'v2.11.0':193C,222C,235C 'v2.12.0':194C 'v2.13.0':195C,223C,236C 'v2.14.0':196C 'v2.15.0':197C,224C,237C 'v2.16.0':198C 'v2.17.0':199C,225C,238C 'v2.18.0':200C 'v2.19.0':201C,226C,239C 'v2.19.5':209C 'v2.2.0':184C 'v2.3.0':185C,218C,231C 'v2.4.0':186C 'v2.5.0':187C,219C,232C 'v2.7.0':189C,220C,233C 'v2.8.0':190C 'v2.9.0':191C,221C,234C 'v3.0.0':202C 'v3.1.0':203C,227C,241C 'v3.2.0':204C 'v3.3.0':205C,228C,242C 'v3.4.0':206C 'v3.5.0':207C,229C,243C 'v3.6.0':211C 'valid':283C 'vega':4A,44B,83C,99C,136C,168C,281C,416C 'version':172C,273C,313C,326C,333C,353C 'via':82C,98C 'victim':60B 'viewer':10A 'visual':5A,45B,169C,403C,417C 'window':372C 'workaround':388C 'write':38B,150C,394C,399C 'xss':132C","nicknames":[],"mitigations":[],"who_affected":"Self-managed OpenSearch Dashboards instances in the affected version ranges are exposed when users with dashboard write permissions can save visualizations that other users open. Amazon OpenSearch Service domains on the listed versions are also affected until the service software update is applied. Amazon OpenSearch Serverless is not affected, and deployments where only trusted users can write saved objects carry much less risk.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-08T20:18:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-102-aws/#CVE-2026-84942","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-102-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T18:56:54+00:00","fetched_at":"2026-10-24T18:56:54+00:00","note":"AWS: CVE-2026-84942 - Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards"},{"source":"nvd","external_id":"CVE-2026-84942","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84942","severity":null,"published_at":"2026-09-08T20:18:51+00:00","modified_at":"2026-09-09T21:17:05+00:00","first_seen_at":"2026-10-24T19:23:38+00:00","fetched_at":"2026-10-24T19:23:38+00:00","note":null},{"source":"epss","external_id":"CVE-2026-84942","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84942","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":2912,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-102-aws/","title":"AWS: CVE-2026-84942 - Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards","kind":"advisory","source":"lab","text":"CVE-2026-84942 - Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards\n\n### CVE-2026-84942 - Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards\n\nBulletin ID: 2026-102-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/08/2026 12:30 PM PDT\n\nDescription:\n\nA stored cross-site scripting (XSS) issue in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization.\n\nAffedted products & versions:\n\n- OpenSearch Dashboards (open-source, self-managed) - Affected: v2.0.0, v2.1.0, v2.2.0, v2.3.0, v2.4.0, v2.5.0, v.2.6.0, v2.7.0, v2.8.0, v2.9.0, v2.10.0, v2.11.0, v2.12.0, v2.13.0, v2.14.0, v2.15.0, v2.16.0, v2.17.0, v2.18.0, v2.19.0, v3.0.0, v3.1.0, v3.2.0, v3.3.0, v3.4.0, v3.5.0 - Fixed: v2.19.5 and v3.6.0 \n- Amazon OpenSearch Service (AWS Managed) - Affected: v2.3.0, v2.5.0, v2.7.0, v2.9.0, v2.11.0, v2.13.0, v2.15.0, v2.17.0, v2.19.0, v3.1.0, v3.3.0, v3.5.0 - Fixed: v2.3.0, v2.5.0, v2.7.0, v2.9.0, v2.11.0, v2.13.0, v2.15.0, v2.17.0, v2.19.0 and v3.1.0, v3.3.0, v3.5.0 \n- Amazon OpenSearch Serverless - Not affected\n\nResolution:\n\nFor OpenSearch (open-source), this issue has been addressed in OpenSearch Dashboards 2.19.5 and 3.6.0. We recommend upgrading to one of these versions or later, which includes additional hardening of Vega expression validation, and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nFor Amazon OpenSearch Service (managed), this issue has been addressed and patched in all affected versions. We recommend that customers update their domains to the latest service software version as soon as possible. No engine version upgrade is required. You can apply the update from the console by selecting your domain, choosing Actions, Service Software Version, then clicking Update. Domains with automatic software updates enabled receive this update during their next off-peak window with no action required. For full details, see Service software updates in Amazon OpenSearch Service.\n\nWorkarounds:\n\nBecause this issue requires dashboard/visualization write permissions to reproduce, restrict write access to the visualization and saved-object APIs to trusted users only. Optionally, disable the Vega visualization type. These measures reduce impact until the update is applied.\n\nReferences:\n\n- CVE-2026-84942\n- OpenSearch Dashboards - Update checkForFunctionProperty to handle arrays- #11404\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}