CVE-2026-19311: OpenSearch Alerting Auth Bypass Flaw

CVE-2026-19311 Overview

CVE-2026-19311 is a missing authorization flaw in the Execute Monitor API of the Amazon OpenSearch Alerting plugin. An authenticated remote user can craft an inline monitor request that specifies unintended data source and input index parameters. The Execute Monitor endpoint fails to validate that the requester has permission to access those referenced indices. As a result, an attacker with low privileges can read, modify, or delete arbitrary index data belonging to other tenants or users on the cluster. The issue is tracked under [CWE-475] and is documented in GitHub Security Advisory GHSA-xxpg-q3wh-685q.

Critical Impact
Any authenticated user of an affected OpenSearch cluster can bypass index-level access controls and manipulate data across the entire cluster through the Alerting plugin.

Affected Products

Amazon OpenSearch Service (versions prior to 3.5)
OpenSearch Alerting plugin (opensearch-project/alerting)
Self-managed OpenSearch deployments running the vulnerable Alerting plugin

Discovery Timeline

2026-08-12 - CVE-2026-19311 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-19311

Vulnerability Analysis

The OpenSearch Alerting plugin exposes an Execute Monitor API used to test monitor definitions before persisting them. This API accepts inline monitor definitions that include a data source and one or more input index targets. In vulnerable releases, the plugin executes the inline monitor query against the specified indices without verifying that the caller has authorization on those indices.

The result is a horizontal and vertical privilege escalation primitive. An authenticated user with permission to invoke the Alerting API can direct queries at indices they should not be able to read, and the monitor engine returns the matched documents in its response payload. Depending on how the monitor action pipeline is configured, the same primitive can be used to write to or delete data in the targeted indices.

Root Cause

The Execute Monitor request handler does not enforce index-level access control on the user-supplied input index and data source fields. Authorization checks apply only to the monitor API itself, not to the downstream indices referenced by the inline monitor. This missing authorization check maps to [CWE-475] and represents a broken access control condition in the plugin's request pipeline.

Attack Vector

Exploitation requires network access to the OpenSearch REST API and any authenticated account with permission to call the Alerting plugin's Execute Monitor endpoint. User interaction is not required. An attacker submits a crafted POST request to the Execute Monitor route with an inline monitor body that references arbitrary indices in the cluster. The plugin executes the query with plugin-level privileges and returns the results, bypassing the requester's intended index scope. No verified public proof-of-concept has been published at the time of writing. Refer to AWS Security Bulletin 2026-078 for vendor-confirmed technical detail.

Detection Methods for CVE-2026-19311

Indicators of Compromise

Requests to the Alerting plugin Execute Monitor endpoint (POST /_plugins/_alerting/monitors/_execute) originating from user accounts that do not typically manage monitors.
Inline monitor request bodies that reference indices outside the caller's normal working set, including system indices or indices belonging to other tenants.
Unusual read volume or document counts returned by Execute Monitor API responses.

Detection Strategies

Correlate OpenSearch audit logs with role assignments to flag Execute Monitor calls whose input.search.indices values are not covered by the caller's role permissions.
Alert on any Execute Monitor invocation that targets sensitive index patterns such as .kibana*, .opendistro*, or customer-tenant indices from a low-privilege principal.
Baseline expected Alerting API usage per user and identify deviations in request frequency, target indices, and payload structure.

Monitoring Recommendations

Enable OpenSearch security audit logging with REST and TRANSPORT layer coverage and forward events to a centralized analytics platform.
Retain full request bodies for Alerting plugin endpoints so that inline monitor definitions can be inspected retroactively.
Monitor cluster-wide document delete and update rates for spikes that coincide with Execute Monitor activity.

How to Mitigate CVE-2026-19311

Immediate Actions Required

Upgrade Amazon OpenSearch Service domains to version 3.5 or later, which contains the fix per the AWS OpenSearch Service Update.
For self-managed OpenSearch, update the Alerting plugin to the patched release identified in GHSA-xxpg-q3wh-685q.
Audit which roles currently grant access to the Alerting plugin API and remove the grant from users who do not need it.

Patch Information

Amazon addressed the issue in Amazon OpenSearch Service version 3.5. Customers running managed domains should initiate an in-place version upgrade through the AWS console or API. Operators of self-managed clusters must update the opensearch-alerting plugin to the fixed version referenced in the GitHub Security Advisory and restart affected nodes. Consult AWS Security Bulletin 2026-078 for the authoritative list of fixed versions.

Workarounds

Restrict the Alerting plugin API to a small set of trusted administrator roles using OpenSearch Security role mappings until the patch is applied.
Place a reverse proxy or API gateway in front of the OpenSearch REST endpoint and block POST requests to /_plugins/_alerting/monitors/_execute from non-administrative principals.
Enforce fine-grained access control and document-level security on sensitive indices so that unauthorized reads returned through the Alerting API are minimized.

bash

# Example: restrict the Execute Monitor route at an nginx reverse proxy
# Refer to the vendor advisory for the authoritative mitigation.
location ~* ^/_plugins/_alerting/monitors/_execute {
    if ($remote_user !~* "^(alerting-admin|secops-admin)$") {
        return 403;
    }
    proxy_pass https://opensearch.internal:9200;
}