8.8
High
CVE-2026-83497 Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows…
Description
Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search permissions to execute arbitrary code on the server by sending a crafted cursor parameter to the plugins/sql endpoint.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenSearch 2.8 | 2.8 → 3.6 | No fix stated |
| Amazon OpenSearch Service 2.9 | 2.9 → 3.5 | No fix stated |