CVE-2026-77811 Overview
CVE-2026-77811 is a stored cross-site scripting (XSS) vulnerability in the dashboards-observability plugin of OpenSearch Dashboards. The flaw stems from improper input validation [CWE-79] when handling saved assets containing arbitrary web content. An authenticated user with write permissions to OpenSearch Dashboards saved objects can upload a crafted asset that executes JavaScript in the browser sessions of other users who view it. The issue affects OpenSearch Dashboards versions prior to 2.19.6 and 3.4.0.
Critical Impact
An authenticated attacker with saved-object write permissions can execute arbitrary JavaScript in victim browsers, enabling session hijacking, data exfiltration from the Dashboards UI, and pivot into higher-privileged accounts.
Affected Products
- OpenSearch Dashboards dashboards-observability plugin versions prior to 2.19.6
- OpenSearch Dashboards dashboards-observability plugin versions prior to 3.4.0
- Amazon OpenSearch Service deployments running affected Dashboards versions (see AWS Security Bulletin 2026-088)
Discovery Timeline
- 2026-08-21 - CVE-2026-77811 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-77811
Vulnerability Analysis
The dashboards-observability plugin extends OpenSearch Dashboards with observability features including notebooks, panels, and integrations that persist as saved objects. The vulnerability arises because the plugin fails to sanitize or validate content within these saved assets before rendering it in the browser. When a user uploads or saves an asset containing embedded HTML or JavaScript, the payload is stored server-side and later executed when any authenticated user renders that asset in the Dashboards UI.
Because execution occurs in the victim's authenticated Dashboards origin, the injected script inherits access to session cookies, CSRF tokens, and API endpoints that the victim can reach. An attacker can chain the primitive to issue authenticated API requests, exfiltrate index data visible to the victim, or modify saved objects owned by higher-privileged users. The vulnerability requires user interaction, since the payload only fires when a victim opens the malicious asset.
Root Cause
The plugin accepts arbitrary web content in saved assets and renders it without sufficient output encoding or Content Security Policy enforcement. Input validation is missing at the ingest path, and the downstream renderer treats stored content as trusted, violating standard XSS defenses defined in [CWE-79].
Attack Vector
An authenticated user with write access to saved objects crafts an observability asset (such as a notebook or integration payload) embedding a JavaScript payload. The attacker saves the asset to a shared workspace. When another Dashboards user opens the asset, the browser parses and executes the attacker-controlled script within the victim's authenticated session context. Full technical detail is available in the GitHub Security Advisory GHSA-rmqx-r3wm-3px5.
Detection Methods for CVE-2026-77811
Indicators of Compromise
- Saved objects in the .kibana or OpenSearch Dashboards system index containing <script> tags, javascript: URIs, or event-handler attributes (onerror, onload) within observability notebook or integration fields.
- Outbound network requests from Dashboards user browsers to unfamiliar domains shortly after opening observability assets.
- Unexpected saved-object modifications performed with credentials of users who only viewed a shared notebook.
Detection Strategies
- Query the saved-objects index for observability documents containing HTML control characters or script keywords and review recent creators.
- Correlate Dashboards audit logs with browser telemetry to identify sessions where a saved-object view triggered anomalous API calls.
- Baseline legitimate observability content and alert on deviations in field length or embedded markup patterns.
Monitoring Recommendations
- Enable OpenSearch security audit logging for saved-object create, update, and access events.
- Forward Dashboards access logs and browser Content Security Policy violation reports to a centralized analytics platform.
- Review permissions granted to the observability_full_access and equivalent roles, and monitor accounts with saved-object write scope for unusual authoring activity.
How to Mitigate CVE-2026-77811
Immediate Actions Required
- Upgrade OpenSearch Dashboards to version 2.19.6 or 3.4.0 or later as published in the OpenSearch 2.19.6 release artifacts and OpenSearch 3.4.0 release artifacts.
- Audit existing observability saved objects for embedded scripts and delete or sanitize any suspicious entries before user access resumes.
- Rotate session credentials for Dashboards users who may have opened attacker-controlled assets prior to patching.
Patch Information
The OpenSearch project fixed the input validation flaw in the dashboards-observability plugin bundled with OpenSearch Dashboards 2.19.6 and 3.4.0. Amazon OpenSearch Service customers should follow guidance in AWS Security Bulletin 2026-088 to confirm their domain versions are patched.
Workarounds
- Restrict saved-object write permissions in the observability plugin to a minimal set of trusted administrators until upgrading.
- Segment Dashboards tenants so untrusted authors cannot share observability assets with privileged users.
- Enforce a strict Content Security Policy at the reverse proxy fronting Dashboards to block inline script execution as a defense-in-depth control.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
