CVE-2026-19311- Missing Authorization in OpenSearch Alerting Plugin

The collected bulletin did not provide a separate affected-products list. Check the original bulletin before making an exposure decision.

Impacted versions: OpenSearch Alerting Plugin (open-source, self-managed): - Affected: 2.4.0 through 2.19.5, 3.0.0 through 3.7.0 - Fixed: 2.19.6, 3.8.0 Amazon OpenSearch Service (AWS Managed): - Affected: All domains running engine versions 2.4 through 3.5 - Fixed: Service software R20260428-P3 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.

1. Sep 9, 2026 at 9:50 PM UTC
   • The vendor changed the advisory's last-updated date.
2. Sep 9, 2026 at 9:30 PM UTC
   • The vendor changed the advisory's last-updated date.
3. Aug 20, 2026 at 9:50 PM UTC
   • The vendor changed the advisory's last-updated date.

1. Aug 20, 2026 at 2:20 AM UTC
   Added to SecurityAlert

   We collected the advisory from the official source.

2. Sep 9, 2026 at 9:30 PM UTC
   Published by AWS

   The publication date reported by the vendor.

3. Sep 13, 2026 at 4:30 AM UTC
   Confirmed at the source

   Our collector saw this advisory during a later source check.