Is CVE-2026-18420 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-18420?

CVE-2026-18420 has a CVSS v3 severity of HIGH (8.8).

Back

CVE-2026-18420

Description

Improper input validation in the Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enables remote code execution. To remediate this issue, users should upgrade to OpenSearch Dashboards 3.8 or later.