Executive Threat Advisory: Telemetry & SIEM Service Disruption

The OpenSearch Project and Amazon Web Services (AWS) have issued coordinated security advisories detailing a high-severity vulnerability affecting OpenSearch Dashboards, the open-source visualization and user interface component for OpenSearch and Elasticsearch-compatible clusters.

Tracked under identifier CVE-2026-75897 with a CVSS v3.1 base score of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H), the vulnerability stems from Uncontrolled Resource Consumption (CWE-400) within the application's core capabilities routing subsystem. An unauthenticated remote attacker can exploit the defect to crash the dashboard process, trigger out-of-memory (OOM) fatal exceptions, and deny service to SOC analysts and DevOps teams relying on real-time log analysis and security monitoring.

Vulnerability Mechanics & Root Cause: Unbounded Route Payload Parsing (CWE-400)

OpenSearch Dashboards is built on a Node.js web application server framework. During normal operation, the client web browser queries the /api/core/capabilities endpoint to negotiate role-based feature availability, UI permissions, and plugin capabilities.

The vulnerability arises from an input validation omission inherited from legacy upstream Kibana code (versions 7.7.1 through 7.10.2):

  1. Unbounded Payload Acceptance: The capabilities HTTP route handler does not enforce a maximum payload body limit (payload.maxBytes) on incoming JSON requests.
  2. Event Loop Blocking: When a remote attacker submits an HTTP POST or GET request with a deeply nested or multi-megabyte JSON body, the Node.js V8 JSON parsing engine blocks the single-threaded event loop while attempting to parse and traverse the object tree.
  3. Memory Exhaustion: Repeated concurrent requests allocate massive heap buffers faster than garbage collection can free them, rapidly driving memory consumption past the V8 heap ceiling (typically 1.4GB - 2GB per process).
  4. Process Crash: The Node.js runtime terminates abruptly with an Allocation failed - JavaScript heap out of memory error, crashing active user sessions and disabling the dashboard interface.

Scope & Impacted Platforms

The vulnerability affects both self-hosted open-source clusters and cloud-managed services:

  • Self-Managed OpenSearch Dashboards: All versions from 1.3.0 through 3.7.0, including 2.x releases up to and including 2.19.6.
  • Amazon OpenSearch Service (AWS Managed): Managed domain engine versions 1.3, 2.11, 2.13, 2.15, 2.17, 2.19, 3.1, 3.3, and 3.5.
  • Amazon OpenSearch Serverless: Confirmed not affected due to separate stateless API architecture.

Remediation Playbook & Mitigation Directives

DevOps and cloud infrastructure administrators should implement the following steps:

1. Upgrade Self-Managed Deployments

Update open-source OpenSearch Dashboards containers or packages to v3.8.0 or later: 

# Docker deployment upgrade example
docker pull opensearchproject/opensearch-dashboards:3.8.0

# Verify installed release
curl -s http://localhost:5601/api/status | jq .version.number
# Output must be >= 3.8.0

2. Apply AWS Managed Service Software Updates

For domains hosted on Amazon OpenSearch Service, initiate the service software update via the AWS CLI: 

# Check service software status
aws opensearch describe-domain   --domain-name production-logs   --query "DomainStatus.ServiceSoftwareOptions"

# Trigger automated zero-downtime rolling update
aws opensearch update-domain-config   --domain-name production-logs   --advanced-options '{"serviceSoftwareUpdate": "true"}'

3. Temporary Reverse Proxy Rate Limiting

For environments unable to patch immediately, configure an ingress reverse proxy (such as NGINX or AWS ALB) in front of Dashboards to restrict payload sizes on capabilities routes: 

location /api/core/capabilities {
    client_max_body_size 64k;
    limit_req zone=dashboards_limit burst=10 nodelay;
    proxy_pass http://dashboards_upstream;
}