OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted `cursor` parameter to the `plugins/sql` endpoint and trigger unsafe deserialization of untrusted data, resulting in arbitrary code execution on the server. This issue is fixed in repository releases 2.19.6.0 and 3.7.0.0.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 8.7 · opensearch-projectNVD modified 2026-10-30 22:22
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 7
- https://github.com/opensearch-project/sql/security/advisories/GHSA-r8cv-xvqm-4qj4 x_refsource_confirm
- https://github.com/opensearch-project/sql/pull/5469 x_refsource_misc
- https://github.com/opensearch-project/sql/pull/5572 x_refsource_misc
- https://github.com/opensearch-project/sql/commit/402a284f1dff3545236480b67f860aa93fb667de x_refsource_misc
- https://github.com/opensearch-project/sql/commit/9ab50384d3ad571a14211415fba2f6d26d4c80db x_refsource_misc
- https://github.com/opensearch-project/sql/releases/tag/2.19.6.0 x_refsource_misc
- https://github.com/opensearch-project/sql/releases/tag/3.7.0.0 x_refsource_misc