CVE-2026-18952: OpenSearch Security Analytics SSRF Flaw

CVE-2026-18952 Overview

CVE-2026-18952 is a Server-Side Request Forgery (SSRF) vulnerability in the OpenSearch Security Analytics plugin. The flaw resides in the threat intelligence feed parser, which fails to validate URL parameters submitted to the threat intel source configuration endpoint. An authenticated remote user can supply a crafted URL to coerce the OpenSearch node into issuing arbitrary outbound requests or reading local files. AWS published guidance in Security Bulletin 2026-079 covering the issue and remediation for AWS OpenSearch Service. The vulnerability is tracked under CWE-918: Server-Side Request Forgery.

Critical Impact
Authenticated attackers can pivot into internal networks, access cloud metadata endpoints, and disclose local file contents from OpenSearch cluster nodes.

Affected Products

OpenSearch Security Analytics plugin
AWS OpenSearch Service (see AWS Security Bulletin 2026-079)
OpenSearch clusters running the threat intelligence feed feature

Discovery Timeline

2026-08-12 - CVE-2026-18952 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-18952

Vulnerability Analysis

The OpenSearch Security Analytics plugin ingests threat intelligence feeds from URLs configured through a dedicated management API. The threat intel source configuration endpoint accepts a URL parameter that specifies where the plugin should fetch indicator data. The parser does not validate this URL against an allowlist, block internal address ranges, or restrict supported schemes.

An authenticated user with permission to configure threat intel sources can point the parser at arbitrary destinations. The server then executes the request from its own network position and returns response data or errors that can leak file contents. This creates both an SSRF primitive and a local file read primitive using schemes such as file:// handled by the underlying HTTP client.

Root Cause

The defect is missing input validation on a user-supplied URL parameter before it reaches the HTTP fetch routine. There is no scheme filtering, no destination allowlist, and no verification that the target is a legitimate external threat feed. This matches the CWE-918 pattern where a web application accepts a URL and issues the request on behalf of the caller.

Attack Vector

Exploitation requires network access to the OpenSearch REST API and valid credentials with permission to configure threat intel sources. The attacker submits a crafted configuration payload containing a malicious URL. Typical targets include cloud instance metadata services, internal admin interfaces reachable only from the cluster, and local files referenced through file-scheme URLs. The plugin then performs the fetch and either returns the retrieved content in an error path or renders it as parsed feed data.

No verified exploit code is publicly available. Refer to the AWS Security Bulletin 2026-079 for vendor-supplied technical context.

Detection Methods for CVE-2026-18952

Indicators of Compromise

Outbound HTTP requests from OpenSearch nodes to non-feed destinations such as 169.254.169.254, RFC1918 ranges, or localhost
Threat intel source configuration entries pointing to URLs with file://, gopher://, or non-HTTPS schemes
Unexpected read access to local files or credential material on OpenSearch hosts
Audit log entries showing repeated PUT or POST requests to the threat intel source configuration endpoint from a single principal

Detection Strategies

Inspect OpenSearch audit logs for changes to threat intel source configurations and validate each configured URL against an approved feed list
Deploy egress filtering that blocks OpenSearch nodes from reaching internal management endpoints and cloud metadata services, then alert on denied connections
Correlate authentication events with configuration API calls to surface low-privileged accounts touching threat intel settings

Monitoring Recommendations

Forward OpenSearch audit and access logs to a centralized analytics platform for retention and query
Baseline normal threat feed destinations and alert on deviations
Monitor process-level network activity on OpenSearch hosts for unexpected outbound connections initiated by the JVM

How to Mitigate CVE-2026-18952

Immediate Actions Required

Apply the AWS OpenSearch Service software update referenced in AWS Security Bulletin 2026-079 or upgrade self-managed OpenSearch clusters to a version containing the patched Security Analytics plugin
Restrict the security_analytics_full_access and equivalent roles so only trusted administrators can configure threat intel sources
Audit existing threat intel source configurations and remove any URLs that do not correspond to sanctioned external feeds

Patch Information

AWS has released a service software update for AWS OpenSearch Service that addresses this vulnerability. Customers should follow the update procedure documented in the AWS OpenSearch Service Software Guide. Self-managed OpenSearch operators should track the OpenSearch project release notes and upgrade the Security Analytics plugin to the fixed version.

Workarounds

Disable the Security Analytics plugin threat intelligence feed feature on clusters that do not require it
Enforce network egress controls on OpenSearch nodes to block outbound requests to internal networks, cloud metadata services, and non-standard ports
Require role-based access control changes so that threat intel source management is limited to a small administrative group
Place OpenSearch cluster management APIs behind an authenticated proxy that enforces URL allowlisting for feed configuration requests

bash

# Configuration example - AWS OpenSearch Service software update check
aws opensearch describe-domain --domain-name my-domain \
  --query 'DomainStatus.ServiceSoftwareOptions'

# Initiate the service software update once a patched version is available
aws opensearch start-service-software-update --domain-name my-domain