CVE-2026-63393
OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution
- State
- Published
- Severity
- 8.7 High
- Published
- Oct 30, 2026
- Updated
- Oct 30, 2026
- Reserved
- Jul 16, 2026
Description
OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted `cursor` parameter to the `plugins/sql` endpoint and trigger unsafe deserialization of untrusted data, resulting in arbitrary code execution on the server. This issue is fixed in repository releases 2.19.6.0 and 3.7.0.0.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | GitHub_M |
Weaknesses
- CWE-502 Deserialization of Untrusted Data
Affected Products
| Product | Versions |
|---|---|
sqlopensearch-project |
|
References
- https://github.com/opensearch-project/sql/security/advisories/GHSA-r8cv-xvqm-4qj4
- https://github.com/opensearch-project/sql/pull/5469
- https://github.com/opensearch-project/sql/pull/5572
- https://github.com/opensearch-project/sql/commit/402a284f1dff3545236480b67f860aa93fb667de
- https://github.com/opensearch-project/sql/commit/9ab50384d3ad571a14211415fba2f6d26d4c80db
- https://github.com/opensearch-project/sql/releases/tag/2.19.6.0
- https://github.com/opensearch-project/sql/releases/tag/3.7.0.0
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.