CVE-2026-64686

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64686", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-20T17:12:12.892Z", "datePublished": "2026-11-11T04:10:36.576Z", "dateUpdated": "2026-11-11T04:10:36.576Z"}, "containers": {"cna": {"title": "OpenSearch Dashboards: SSRF in fetchDataSourceMetaData \u2014 missing endpoint validation", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/opensearch-project/OpenSearch-Dashboards/security/advisories/GHSA-6qp6-3675-ffr3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/opensearch-project/OpenSearch-Dashboards/security/advisories/GHSA-6qp6-3675-ffr3"}, {"name": "https://github.com/opensearch-project/OpenSearch-Dashboards/releases/tag/2.19.6", "tags": ["x_refsource_MISC"], "url": "https://github.com/opensearch-project/OpenSearch-Dashboards/releases/tag/2.19.6"}, {"name": "https://github.com/opensearch-project/OpenSearch-Dashboards/releases/tag/3.7.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/opensearch-project/OpenSearch-Dashboards/releases/tag/3.7.0"}], "affected": [{"vendor": "opensearch-project", "product": "OpenSearch-Dashboards", "versions": [{"version": ">= 2.14.0, < 2.19.6", "status": "affected"}, {"version": ">= 3.0.0, < 3.7.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-11T04:10:36.576Z"}, "descriptions": [{"lang": "en", "value": "OpenSearch Dashboards is an open-source data visualization tool designed to work with OpenSearch. From versions 2.14.0 to before 2.19.6, and 3.0.0 to before 3.7.0, a Server-Side Request Forgery (SSRF) vulnerability in OpenSearch Dashboards exists in the fetchDataSourceMetaData route. The sibling test_connection route validates incoming endpoint URLs via isValidURL() against configured endpointDeniedIPs and endpointAllowlistedSuffixes lists, but fetchDataSourceMetaData accepts the same input shape without performing this validation. An authenticated user can supply an internal or loopback endpoint to probe internal network resources. This issue has been patched in versions 2.19.6 and 3.7.0."}], "source": {"advisory": "GHSA-6qp6-3675-ffr3", "discovery": "UNKNOWN"}}}}

{}

{"affected": [{"affectedData": [{"product": "OpenSearch-Dashboards", "vendor": "opensearch-project", "versions": [{"status": "affected", "version": ">= 2.14.0, < 2.19.6"}, {"status": "affected", "version": ">= 3.0.0, < 3.7.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenSearch Dashboards is an open-source data visualization tool designed to work with OpenSearch. From versions 2.14.0 to before 2.19.6, and 3.0.0 to before 3.7.0, a Server-Side Request Forgery (SSRF) vulnerability in OpenSearch Dashboards exists in the fetchDataSourceMetaData route. The sibling test_connection route validates incoming endpoint URLs via isValidURL() against configured endpointDeniedIPs and endpointAllowlistedSuffixes lists, but fetchDataSourceMetaData accepts the same input shape without performing this validation. An authenticated user can supply an internal or loopback endpoint to probe internal network resources. This issue has been patched in versions 2.19.6 and 3.7.0."}], "id": "CVE-2026-64686", "lastModified": "2026-11-12T22:11:01.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-11-11T05:19:52.350", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/opensearch-project/OpenSearch-Dashboards/releases/tag/2.19.6"}, {"source": "security-advisories@github.com", "url": "https://github.com/opensearch-project/OpenSearch-Dashboards/releases/tag/3.7.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/opensearch-project/OpenSearch-Dashboards/security/advisories/GHSA-6qp6-3675-ffr3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"created": "2026-11-12T03:15:19.495373+00:00", "updated": "2026-11-12T20:15:08.436797+00:00", "vendors": []}