Does your OpenSearch Dashboards version 1.3.0 to 3.7.0 have a denial of service vulnerability?

The short version

• AWS Security Bulletin 2026-082-AWS details a denial of service vulnerability in OpenSearch Dashboards.
• The flaw stems from the capabilities route handler accepting oversized HTTP requests without validation.
• Fixes are available for all affected managed service versions and self-managed installations.

The details

AWS published bulletin 2026-082-AWS on 18 August 2026, describing CVE-2026-75897. The advisory identifies improper input validation within the capabilities route handler of OpenSearch Dashboards. According to the bulletin, the handler fails to bound the size of incoming request payloads. This oversight might allow remote attackers to trigger a denial of service by sending crafted HTTP requests to the interface.

The vulnerability impacts OpenSearch Dashboards versions 1.3.0 through 3.7.0 inclusive. This range covers all 2.x releases up to 2.19.6. AWS notes the issue is inherited from upstream Kibana, specifically affecting versions 7.7.1 through 7.10.2. For self-managed deployments, the vendor advises upgrading to OpenSearch Dashboards 3.8.0 or later to incorporate the fix.

The context

Amazon OpenSearch Service customers face exposure across multiple engine versions. Affected managed domains include OpenSearch 1.3, 2.11, 2.13, 2.15, 2.17, 2.19, 3.1, 3.3, and 3.5. Elasticsearch-compatibility versions using Kibana 7.9 and 7.10 are also vulnerable. AWS confirms that a patched service software release is available for all these versions. Users should apply the latest available update via the console or API.

Next steps

Teams should verify their current OpenSearch Dashboards versions against the affected list. Those on AWS managed service should check the Notifications panel for available updates. Self-managed users must plan an upgrade to version 3.8.0. Deployments using Amazon OpenSearch Serverless require no action. Forked or derivative code should be re-patched to include the new fixes.

What defenders should look for

Teams usually monitor web server logs for unusually large POST requests targeting the capabilities endpoint. Sudden spikes in response times or connection timeouts may indicate resource exhaustion attempts. Check whether authentication layers are correctly blocking unauthorised access to the dashboard interface. Investigate any failed authentication attempts followed by heavy traffic from single sources. Ensure load balancers are configured to reject oversized payloads before they reach the application layer.

Background: Input validation

Input validation works by comparing incoming data against a strict model of allowed values, types and lengths. It rejects anything that deviates from this model before processing. This prevents malformed data from triggering logic errors or executing unintended commands within the application.

Read the full guide: Input Validation Mechanics: How Parsing Blocks Attacks

What to do and how to stay safe: OpenSearch

• Verify if your environment runs OpenSearch Dashboards version 1.3.0 through 3.7.0.
• Apply the latest service software update to all affected Amazon OpenSearch Service domains.
• Upgrade self-managed installations to OpenSearch Dashboards 3.8.0 or later.
• Ensure reverse proxies or load balancers enforce strict payload size limits.

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which OpenSearch versions are affected by CVE-2026-75897?

Versions 1.3.0 through 3.7.0 are affected, including Kibana 7.7.1 through 7.10.2.

Is Amazon OpenSearch Serverless vulnerable?

No, AWS states that no action is required for Amazon OpenSearch Serverless deployments.

Can authentication prevent this attack?

Yes, placing an authentication layer in front of the process protects the route as it is only reachable post-authentication.