High severity · published Aug 12, 2026
CVE-2026-19311
Missing Authorization in Execute Monitor API in OpenSearch Alerting Plugin
8.1
CVSS
0.6%
EPSS
No
On KEV
Description
Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpenSearch · AWS
2.4 through 3.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-19311
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-19311
aws.amazon.com
https://aws.amazon.com/about-aws/whats-new/2026/03/amazon-opensearch-service-version-3-5/
aws.amazon.com
https://aws.amazon.com/security/security-bulletins/2026-078-aws/
github.com
https://github.com/opensearch-project/alerting/security/advisories/GHSA-xxpg-q3wh-685q
More from OpenSearch
8.8
CVE-2026-18428
SQL Query Validation Bypass in OpenSearch Direct Query
8.1
CVE-2026-18952
Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics Plugin