Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

OpenSearch SQL plugin lets attacker run code on server

CVE-2026-63393 · published 1 day ago
Summary

A user who can read data can send a specially crafted request to the OpenSearch SQL feature, causing the server to execute any code the attacker chooses. This happens because the request is not checked safely. Upgrade the OpenSearch SQL plugin to version 2.19.6.0 or newer (or 3.7.0.0 or newer) to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
opensearch-project sql >= 2.8.0.0, < 2.19.6.0
Original advisory text
OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution
OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted `cursor` parameter to the `plugins/sql` endpoint and trigger unsafe deserialization of untrusted data, resulting in arbitrary code execution on the server. This issue is fixed in repository releases 2.19.6.0 and 3.7.0.0.
References
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen30 Oct 2026
Sources
CVE-2026-63393 · NVD
CVE-2026-63393 · MITRE
CVE-2026-63393 · OSV
GHSA-r8cv-xvqm-4qj4 · GHSA
Track software like this
Free during beta