In plain language
What this advisory means
A security issue was found in the OpenSearch Alerting plugin used by Amazon Web Services. This problem could let users who already have a certain alerting access permission read, change, or delete data they should not control by sending a specially crafted request. To fix this, users should update the OpenSearch Alerting plugin or Amazon OpenSearch Service to the latest versions that include the security patch.
Technical explanation
How the issue affects the environment
CVE-2026-19311 is a missing authorization vulnerability in the Execute Monitor API within the OpenSearch Alerting plugin. Authenticated users with alerting_full_access role can exploit this flaw by crafting inline monitor requests with manipulated data source and input index parameters to read, modify, or delete arbitrary index data without proper permission checks. The affected open-source plugin versions span 2.4.0 to 2.19.5 and 3.0.0 to 3.7.0; fixed in versions 2.19.6 and 3.8.0. AWS-managed OpenSearch Service domains running engine versions 2.4 through 3.5 are also affected, with remediation provided via service software update R20260428-P3.
Operational impact
Why teams should care
If unaddressed, this vulnerability allows users with alerting_full_access to tamper with data indexes beyond their authorized scope, risking unauthorized data exposure, modification, or deletion. This could lead to data integrity compromises, operational disruptions, and potential loss of user trust. Organizations must prioritize patching or applying mitigations to maintain data security and service reliability.
Immediate action
Open-source users should upgrade to OpenSearch Alerting Plugin versions 2.19.6 or 3.8.0 or later to address the input validation issue in the Execute Monitor API. AWS-managed users should apply the service software update R20260428-P3 via the AWS console or rely on automatic updates during off-peak hours.
Affected and fixed releases
Temporary risk reduction
If immediate upgrading is not feasible, restrict usage of the alerting_full_access role exclusively to trusted administrators to limit exploit risk.
Evidence and validation checklist
- AWS official security bulletin ID 2026-078-AWS dated 08/12/2026
- CVE-2026-19311 description in AWS Security Bulletins
- Version information and remediation steps published by AWS
- Guidance on restricting alerting_full_access role as a workaround
Authoritative reference
AWS Security Bulletins
QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.