Security Advisory Desk
unratedQCS priority 76/100Amazon Web Services

CVE-2026-84942 - Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards

A security issue was found in OpenSearch Dashboards that could let a user with permission to change dashboards insert harmful code. This code would then run in other users' browsers, potentially exposing their accounts or data.

Published 8/9/2026, 7:57:03 pmVerified 9/9/2026, 1:56:21 pmRevision 1
Amazon Web Services unrated network security advisory visual

In plain language

What this advisory means

A security issue was found in OpenSearch Dashboards that could let a user with permission to change dashboards insert harmful code. This code would then run in other users' browsers, potentially exposing their accounts or data.

Technical explanation

How the issue affects the environment

OpenSearch Dashboards had a stored cross-site scripting (XSS) vulnerability in the Vega expression function. An authenticated user with write access to dashboards could save a specially crafted Vega visualization containing malicious JavaScript. When other users load this visualization, the JavaScript executes in their browser context, leading to potential session hijacking or data exposure. The issue was patched by strengthening validation of Vega expressions in versions 2.19.5 and 3.6.0 for OpenSearch Dashboards and via managed service updates for Amazon OpenSearch Service.

Operational impact

Why teams should care

Attackers with dashboard write permissions could exploit this flaw to execute arbitrary scripts in other users' browsers. This could lead to unauthorized access, data theft, or session compromise, undermining trust and potentially causing regulatory and reputational damage.

Immediate action

Upgrade OpenSearch Dashboards to version 2.19.5 or later, or version 3.6.0 or later. For Amazon OpenSearch Service, apply the available service software updates via the AWS console or enable automatic updates to get the patch without manual intervention.

Affected and fixed releases

Affected versionsOpenSearch Dashboards v2.0.0 through v3.5.0, Amazon OpenSearch Service versions v2.3.0 through v3.5.0 (selected)
Fixed versionsOpenSearch Dashboards v2.19.5 and v3.6.0, Amazon OpenSearch Service with service software updates from v2.3.0 up to v3.5.0

Temporary risk reduction

Restrict dashboard and visualization write permissions to only trusted users. Optionally, disable the Vega visualization type to prevent exploitation until updates can be applied.

Evidence and validation checklist

  • AWS Security Bulletin dated 09/08/2026 12:30 PM PDT
  • Statement of stored XSS via Vega expression function in OpenSearch Dashboards
  • Lists of affected and fixed versions for OpenSearch Dashboards and Amazon OpenSearch Service
  • Recommended upgrades and service software update procedure
  • Workaround advice limiting visualization write access and disabling Vega visualizations

Authoritative reference

AWS Security Bulletins

QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.

Open source