CVE-2026-75897: OpenSearch Dashboards DoS Vulnerability

CVE-2026-75897 Overview

CVE-2026-75897 is a denial of service vulnerability in the OpenSearch Dashboards capabilities route handler. The handler fails to enforce a size limit on incoming HTTP request payloads. Remote unauthenticated attackers can send crafted requests to exhaust server resources and disrupt Dashboards availability. The weakness is tracked as improper input validation for resource consumption [CWE-1284].

The issue affects OpenSearch Dashboards deployments exposed over the network. Because no authentication or user interaction is required, attack complexity is low. AWS published a security bulletin describing the flaw and referencing updated OpenSearch downloads.

Critical Impact
Unauthenticated remote attackers can trigger denial of service against OpenSearch Dashboards by submitting oversized HTTP payloads to the capabilities route.

Affected Products

OpenSearch Dashboards (capabilities route handler)
Deployments referenced in AWS Security Bulletin 2026-082
Self-managed OpenSearch Dashboards installations prior to the fixed release listed by OpenSearch

Discovery Timeline

2026-08-18 - CVE-2026-75897 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-75897

Vulnerability Analysis

OpenSearch Dashboards exposes a capabilities route that returns feature and plugin capability metadata to clients. The route handler accepts an HTTP request body but does not enforce an upper bound on payload size. An attacker can submit arbitrarily large payloads that the server buffers and processes.

Repeated or concurrent oversized requests consume memory, CPU, and event loop capacity within the Node.js-based Dashboards process. This starves legitimate requests and can drive the process to unresponsiveness or restart loops. The attack requires only network reachability to the Dashboards HTTP endpoint.

Root Cause

The root cause is missing payload size validation on the capabilities route [CWE-1284]. The handler does not apply a maximum body length or reject oversized requests before allocating buffers. Input handling delegates parsing to the underlying HTTP framework without a route-specific ceiling, so resource consumption scales with attacker-supplied input.

Attack Vector

The attack vector is network based and unauthenticated. An attacker sends one or more crafted HTTP requests with large bodies to the capabilities endpoint of an exposed OpenSearch Dashboards instance. Sustained traffic amplifies the impact and can bring down clustered Dashboards nodes behind a load balancer. No credentials, tokens, or user interaction are required to trigger the condition. Refer to the AWS Security Bulletin 2026-082 for vendor-provided technical detail.

Detection Methods for CVE-2026-75897

Indicators of Compromise

Repeated HTTP POST or PUT requests to the OpenSearch Dashboards capabilities route with unusually large Content-Length headers
Sudden spikes in Dashboards process memory or CPU consumption correlated with inbound request volume
Dashboards worker restarts, out-of-memory errors, or 5xx responses in reverse proxy logs

Detection Strategies

Alert on HTTP requests to the capabilities route where request body size exceeds a defined threshold
Correlate reverse proxy access logs with Dashboards process metrics to identify request-driven resource exhaustion
Rate-limit and log repeated requests from single source IPs targeting the capabilities endpoint

Monitoring Recommendations

Monitor Dashboards Node.js process metrics for heap growth, event loop lag, and unexpected restarts
Ingest OpenSearch Dashboards and upstream reverse proxy logs into a centralized analytics platform for anomaly detection
Track error rates on the capabilities route and set thresholds for automated notification

How to Mitigate CVE-2026-75897

Immediate Actions Required

Upgrade OpenSearch Dashboards to the fixed release listed on the OpenSearch downloads page
Restrict network exposure of the Dashboards HTTP endpoint to trusted networks and authenticated users only
Enforce request body size limits at any reverse proxy or ingress controller in front of Dashboards

Patch Information

AWS and the OpenSearch project have released updated OpenSearch Dashboards builds that bound the capabilities route payload. Review the AWS Security Bulletin 2026-082 for the specific fixed versions and apply the corresponding update from the OpenSearch downloads page. Managed OpenSearch Service customers should confirm their service version against AWS guidance.

Workarounds

Place a reverse proxy such as NGINX or an application load balancer in front of Dashboards and cap request body size for the capabilities route
Apply IP allowlisting and require authenticated access to Dashboards where feasible
Deploy rate limiting on the capabilities endpoint to reduce the impact of repeated oversized requests

bash

# Example NGINX request size limit in front of OpenSearch Dashboards
server {
    listen 443 ssl;
    server_name dashboards.example.com;

    client_max_body_size 64k;

    location /api/core/capabilities {
        client_max_body_size 16k;
        limit_req zone=dashboards_cap burst=5 nodelay;
        proxy_pass http://opensearch_dashboards_upstream;
    }
}