CVE-2026-77811
Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenticated user with write permissions to OpenSearch Dashboards saved objects to execute arbitrary JavaScript in the context of other users' browser sessions by uploading a saved asset with arbitrary web content.
- Published Aug 21, 2026
- CVSS 6.2 medium
- 0.5% chance of exploitation in the next 30 days (EPSS)
Affected software
In the news
- CVE-2026-77811 - Stored Cross-Site Scripting via Integration Template Asset in OpenSearch Dashboards AWS Security Bulletins ·