8.7
Élevée
CVE-2026-18428 A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote…
Description
A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| OpenSearch 2.13 | 2.13 → 3.5 | Pas de correctif indiqué |
| OpenSearch 2.13 | 2.13 → 3.6 | Pas de correctif indiqué |