AWS Security Digest·Week 33 of 2026·Aug 10-16, 2026·4 items
Four OpenSearch and SDK Bulletins in Two Days
A quiet week for feature launches turns into a busy one for patching: AWS ships four security bulletins in 48 hours, three touching OpenSearch (authorization bypass, SSRF, and a SQL grammar bypass) and one an out-of-bounds Base64 decoder bug in the AWS SDK for C++.
The Execute Monitor API in the OpenSearch Alerting plugin let an authenticated user holding the alerting_full_access role read, modify, or delete arbitrary index data via a crafted inline monitor request. Affects the plugin 2.4.0-2.19.5 and 3.0.0-3.7.0, and Amazon OpenSearch Service engines 2.4-3.5. Fixed in plugin 2.19.6/3.8.0; AWS-managed domains get it via Service Software Version R20260428-P3 with no engine upgrade required.
Missing input validation in the threat intelligence feed parser of the OpenSearch Security Analytics plugin let authenticated users with certain security roles trigger server-side request forgery and local file access through a crafted URL on the threat intel source configuration endpoint. Affects the self-managed plugin and Amazon OpenSearch Service engine versions 2.15.0 and later; fixed in 3.7.0 and later.
Affected
OpenSearch Security Analytics Plugin >= 2.15.0
Fixed In
OpenSearch Security Analytics Plugin 3.7.0+
OpenSearch
medium/CVE/
CVE-2026-19642 / CVE-2026-19643: Out-of-Bounds Base64 Decoding in the AWS SDK for C++
Certain inputs to the Base64 decoder in the AWS SDK for C++ core library could write past the end of a heap-allocated output buffer (CVE-2026-19642, for which the bulletin states remote code execution was not demonstrated) or read outside the bounds of the decode table on some platforms and crash the decoding process (CVE-2026-19643). Affects SDK for C++ <= 1.11.861; fixed in 1.11.862, which delegates Base64 decoding to aws-crt-cpp.
The Flint extension query handler in the OpenSearch SQL plugin validated queries without sufficient restriction, letting a user with async query access bypass the SQL grammar deny list via the direct query endpoint when Spark-based external data source integration is enabled. Affects self-managed plugin 2.13-3.6 and Amazon OpenSearch Service 2.13-3.5; fixed in open-source 2.19.6/3.7, and via service update for AWS-managed domains. Mitigation: restrict async query access to trusted users if unpatched.
Affected
OpenSearch SQL Plugin 2.13-3.6 (self-managed); Amazon OpenSearch Service 2.13-3.5
Fixed In
OpenSearch SQL Plugin 2.19.6 / 3.7
OpenSearch
Key Takeaway
1 item
$ cat WEEKLY_SUMMARY.md
This week is pure plumbing: no incidents, no feature launches, just four bulletins landing back-to-back on OpenSearch and the C++ SDK. If you run self-managed OpenSearch with Alerting, Security Analytics, or SQL/Flint enabled, patch this batch together rather than one at a time - three of the four sit in the same product area and share the same August 12-13 disclosure window.
These weekly digests are a starting point. Contact us for tailored threat briefings, security assessments, and architectural guidance for your AWS environment.
