CVE-2026-84942: OpenSearch Dashboards RCE Vulnerability

CVE-2026-84942 Overview

CVE-2026-84942 is a stored cross-site scripting (XSS) vulnerability in OpenSearch Dashboards. The flaw resides in the Vega expression function implementation, where improper input validation allows a remote authenticated user with dashboard write permissions to execute arbitrary JavaScript in the browser sessions of other users. Attackers exploit the vulnerability by saving a crafted Vega visualization. The checkForFunctionProperty validation routine fails to recurse into arrays of objects, letting a function property nested inside an array bypass validation. The issue is tracked under CWE-79.

Critical Impact
An authenticated user with dashboard write permissions can execute arbitrary JavaScript in the browser context of any other user who views the crafted Vega visualization, enabling session hijacking and data exfiltration.

Affected Products

OpenSearch Dashboards versions prior to 2.19.5
OpenSearch Dashboards versions prior to 3.6.0
Amazon OpenSearch Service deployments running affected versions

Discovery Timeline

2026-09-08 - CVE-2026-84942 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-84942

Vulnerability Analysis

OpenSearch Dashboards supports Vega visualizations, which allow users to define chart specifications using a JSON-based grammar. To prevent code execution through embedded JavaScript functions, Dashboards runs a validation routine called checkForFunctionProperty against saved specifications.

The validation walks the specification object graph and rejects properties whose values are functions. However, the routine does not recurse into arrays that contain objects. An attacker can nest a function property inside such an array to evade the check. When another user opens the dashboard, the Vega runtime evaluates the smuggled function in the victim's browser session.

Successful exploitation results in stored cross-site scripting. The injected script executes with the privileges of the viewing user, exposing session tokens, dashboard data, and any actions available through the Dashboards API.

Root Cause

The root cause is incomplete recursive traversal in checkForFunctionProperty. The sanitizer inspects nested objects but treats array elements as opaque, so function properties embedded within array-wrapped objects bypass the filter and reach the Vega expression evaluator.

Attack Vector

Exploitation requires network access to OpenSearch Dashboards, an authenticated account with dashboard write permissions, and user interaction from the victim. The attacker saves a malicious Vega visualization. When a targeted user loads the dashboard, the crafted Vega specification triggers arbitrary JavaScript execution in that user's browser session.

No verified public proof-of-concept is available. The vulnerability mechanism is described in the vendor advisories referenced below rather than reproduced here.

Detection Methods for CVE-2026-84942

Indicators of Compromise

Saved Vega visualization specifications containing function properties nested inside array elements, which should not appear in legitimate dashboards.
Unexpected outbound HTTP requests originating from Dashboards user browsers to attacker-controlled domains after loading a shared dashboard.
Audit log entries showing dashboard write operations from accounts that do not typically author Vega visualizations.

Detection Strategies

Scan saved objects in the .kibana or equivalent index for Vega specs containing function tokens or expr fields with suspicious payloads.
Correlate dashboard save events with subsequent view events from privileged users to identify potential victim exposure.
Monitor OpenSearch Dashboards audit logs for anomalous saved_objects/create and saved_objects/update operations targeting visualization types with Vega content.

Monitoring Recommendations

Enable OpenSearch Security audit logging for all saved object mutations and forward events to a centralized SIEM for review.
Alert on browser Content Security Policy (CSP) violations reported by Dashboards users, which may indicate blocked exploit attempts.
Track privilege assignments granting dashboard_write or equivalent roles, especially to newly created accounts.

How to Mitigate CVE-2026-84942

Immediate Actions Required

Upgrade OpenSearch Dashboards to version 2.19.5, 3.6.0, or later, depending on the deployed release train.
Audit all existing Vega visualizations for embedded function properties and remove any that were not authored by trusted users.
Review and reduce the number of accounts holding dashboard write permissions to the minimum required.

Patch Information

The OpenSearch project addressed CVE-2026-84942 in OpenSearch Dashboards Release 2.19.5 and OpenSearch Dashboards Release 3.6.0. Amazon OpenSearch Service customers should consult the AWS Security Bulletin 2026-102 for managed-service remediation guidance. The fix updates checkForFunctionProperty to recurse into arrays and reject function properties at any depth.

Workarounds

Disable the Vega visualization plugin in OpenSearch Dashboards if it is not required by business users.
Restrict the dashboard_write role to a small, trusted set of users until upgrades can be deployed across all clusters.
Enforce a strict Content Security Policy on the Dashboards origin to limit the impact of injected script execution.

bash

# Example: restrict dashboard write role assignments via OpenSearch Security API
curl -XPUT -u admin:admin -k "https://dashboards.example.com:9200/_plugins/_security/api/rolesmapping/dashboard_write" \
  -H 'Content-Type: application/json' \
  -d '{
    "backend_roles": [],
    "hosts": [],
    "users": ["trusted-dashboard-author"]
  }'