🟠 High | Source: AWS Security Bulletins
A missing authorisation flaw (CVE-2026-19311) in the OpenSearch Alerting plugin’s Execute Monitor API allows any authenticated user holding the alerting_full_access role to read, modify, or delete arbitrary index data by crafting a malicious inline monitor request. The issue affects self-managed OpenSearch versions 2.4.0–2.19.5 and 3.0.0–3.7.0, as well as Amazon OpenSearch Service domains running engine versions 2.4 through 3.5. Fixes are available in open-source releases 2.19.6 and 3.8.0, and in AWS managed service software R20260428-P3.
Security Architect’s Take: Prioritise patching self-managed OpenSearch clusters to 2.19.6 or 3.8.0 immediately, and verify that Amazon OpenSearch Service domains have been updated to service software R20260428-P3 — check the console for pending updates and apply them if auto-update has not yet triggered. In the interim, consider restricting assignment of the alerting_full_access role to the minimum necessary users and auditing recent Execute Monitor API activity for anomalous index access patterns.
Original advisory: CVE-2026-19311- Missing Authorization in OpenSearch Alerting Plugin