CVE-2026-19311

Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters.

Scoring

Severity

HIGH

CVSS base score

8.6

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

EPSS probability

0.41%

CWE

CWE-475

Published

2026-08-12

Last modified

2026-08-13

Affected products

• AWS OpenSearch
• Github OpenSearch
• Github OpenSearch

Weakness type

• CWE-475

Related vulnerabilities

• CVE-2026-42009 — Gnutls: gnutls: denial of service via dtls packet reordering vulnerability
• CVE-2026-21690 — iccDEV has Type Confusion in CIccTagXmlTagData::ToXml()
• CVE-2025-47866 — An unrestricted file upload vulnerability in a Trend Micro Apex Central widget below version...
• CVE-2025-47865 — A Local File Inclusion vulnerability in a Trend Micro Apex Central widget below version 8.0.6955...
• CVE-2024-10569 — Zip Bomb Vulnerability in gradio-app/gradio
• CVE-2024-3099 — Denial of Service and Data Model Poisoning via URL Encoding in mlflow/mlflow
• CVE-2024-20380 — ClamAV HTML Parser Denial of Service Vulnerability
• CVE-2023-4874 — Undefined Behavior for Input to API in Mutt

Markdown version · Browse all CVEs