OpenSearch Dashboards: Server-Side Request Forgery in fetchDataSourceMetaData
Summary
OpenSearch Dashboards versions 2.14.0 to before 2.19.6 and 3.0.0 to before 3.7.0 contain a Server-Side Request Forgery (SSRF) flaw in the fetchDataSourceMetaData route. This route does not apply the endpoint validation (denied IPs and allowlisted suffixes) that the sibling test_connection route enforces. An authenticated user can submit internal or loopback endpoints and use the server to probe internal network resources; the impact is limited to confidentiality, with no code execution.
Affected
- OpenSearch Dashboards 2.14.0 up to (not including) 2.19.6
- OpenSearch Dashboards 3.0.0 up to (not including) 3.7.0
Fixed in
- Upgrade to OpenSearch Dashboards 2.19.6 or 3.7.0 (or later).
Workaround
- Unknown. The vendor has not published a workaround. VulDB recommends firewall rules that block outbound connections from the Dashboards server to internal IP ranges and loopback addresses until the update is applied.
Exploitation
- No exploit available according to VulDB at the time of research.
- No reports of in-the-wild exploitation found.
- The CVE was published on 11 November 2026 and NVD analysis was still pending.
Our recommendation
- Upgrade OpenSearch Dashboards to 2.19.6 or 3.7.0 or later.
- Until then, restrict outbound connections from the Dashboards server to internal networks and loopback addresses.
- Review which accounts have Dashboards access and limit it to required users.
- Check whether the data source feature is in use and monitor logs for unusual requests to internal endpoints.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-6qp6-3675-ffr3 github.com
- OpenSearch Dashboards Release 2.19.6 github.com
- OpenSearch Dashboards Release 3.7.0 github.com
- VulDB CVE-2026-64686 vuldb.com
- VulDB entry 435609 vuldb.com
- OffSeq Radar CVE-2026-64686 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:15.
Original description (NVD)
OpenSearch Dashboards is an open-source data visualization tool designed to work with OpenSearch. From versions 2.14.0 to before 2.19.6, and 3.0.0 to before 3.7.0, a Server-Side Request Forgery (SSRF) vulnerability in OpenSearch Dashboards exists in the fetchDataSourceMetaData route. The sibling test_connection route validates incoming endpoint URLs via isValidURL() against configured endpointDeniedIPs and endpointAllowlistedSuffixes lists, but fetchDataSourceMetaData accepts the same input shape without performing this validation. An authenticated user can supply an internal or loopback endpoint to probe internal network resources. This issue has been patched in versions 2.19.6 and 3.7.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.