CVE-2026-63393
Severity not reportedOpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language.
OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted `cursor` parameter to the `plugins/sql` endpoint and trigger unsafe deserialization of untrusted data, resulting in arbitrary code execution on the server. This issue is fixed in repository releases 2.19.6.0 and 3.7.0.0.
Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/opensearch-project/sql/commit/402a284f1dff3545236480b67f860aa93fb667de security-advisories@github.com
- https://github.com/opensearch-project/sql/commit/9ab50384d3ad571a14211415fba2f6d26d4c80db security-advisories@github.com
- https://github.com/opensearch-project/sql/pull/5469 security-advisories@github.com
- https://github.com/opensearch-project/sql/pull/5572 security-advisories@github.com
- https://github.com/opensearch-project/sql/releases/tag/2.19.6.0 security-advisories@github.com
- https://github.com/opensearch-project/sql/releases/tag/3.7.0.0 security-advisories@github.com
- https://github.com/opensearch-project/sql/security/advisories/GHSA-r8cv-xvqm-4qj4 security-advisories@github.com