OpenSearch Dashboard存在未授权访问

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://www.ddpoc.com/DVB-2025-10018.html
• https://repost.aws/zh-Hans/knowledge-center/opensearch-troubleshoot-dashboard
• https://www.volcengine.com/article/25836
• https://docs.aws.amazon.com/opensearch-service/latest/developerguide/handling-errors.html
• https://forum.opensearch.org/t/opensearch-dashboards-openid-authentication-produces-error-401-unauthorized/18811
• https://repost.aws/knowledge-center/anonymous-not-authorized-opensearch

Related Vulnerabilities

• PoCCVE-2026-44343: WGDashboard < 4.3.2 - Unauthenticated File Read
• PoCCVE-2026-59177: ESPHome Device Builder <1.0.10 - Unauthenticated Dashboard Access
• PoCCVE-2026-15733: WGDashboard <= 4.3.2 - Authenticated OS Command Injection /etc/passwd Read
• PoCCVE-2026-53519: Nezha Dashboard < 2.0.13 - Path Traversal
• PoCtrino-unauth-cluster: Trino Cluster Overview - Unauthenticated Dashboard Exposure
• Kubernetes Dashboard /api/v1/namespaces/kube-system/secrets/kubernetes-dashboard-certs 权限绕过漏洞（CVE-2018-18264）
• Nezha Dashboard /dashboard../data/config.yaml 目录遍历漏洞（CVE-2026-53519）
• PoClaravel-pulse-unauth: Laravel Pulse - Unauthenticated Dashboard Access
• PoCpuppetdb-dashboard-unauth: PuppetDB Dashboard - Unauthenticated Access
• Kubeflow Dashboard /api/workgroup/env-info 未授权访问漏洞
• PoCapache-skywalking-dashboard: Apache SkyWalking - Dashboard
• PoCCVE-2025-54597: Heimdall Application Dashboard < 2.7.3 - Reflected XSS
• PoCargo-workflows-unauth: Argo Workflows - Unauthenticated Dashboard