CVE-2026-63393
OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language
- Risk score
- 52/100
- CVSS
- 8.7 v4.0
- Published
- 30 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted cursor parameter to the plugins/sql endpoint and trigger unsafe …
- Affected
- See advisory
- Fix
- Upgrade the product to 3.7.0.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.7 high
References
- https://github.com/opensearch-project/sql/commit/402a284f1dff3545236480b67f860aa93fb667de
- https://github.com/opensearch-project/sql/commit/9ab50384d3ad571a14211415fba2f6d26d4c80db
- https://github.com/opensearch-project/sql/pull/5469
- https://github.com/opensearch-project/sql/pull/5572
- https://github.com/opensearch-project/sql/releases/tag/2.19.6.0
- https://github.com/opensearch-project/sql/releases/tag/3.7.0.0
- https://github.com/opensearch-project/sql/security/advisories/GHSA-r8cv-xvqm-4qj4
Original description
OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted `cursor` parameter to the `plugins/sql` endpoint and trigger unsafe deserialization of untrusted data, resulting in arbitrary code execution on the server. This issue is fixed in repository releases 2.19.6.0 and 3.7.0.0.
Last activity 30 Oct 2026. Patch Forecast updates every hour.