CVE-2026-64686

OpenSearch Dashboards versions 2.14.0 to before 2.19.6 and 3.0.0 to before 3.7.0 are vulnerable to a Server-Side Request Forgery (SSRF) in the fetchDataSourceMetaData route. The root cause is a missing endpoint validation ; while the test_connection route validates URLs against endpointDeniedIPs ...