8.8
Élevée
CVE-2026-83497 Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows…
Description
Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search permissions to execute arbitrary code on the server by sending a crafted cursor parameter to the plugins/sql endpoint.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| OpenSearch 2.8 | 2.8 → 3.6 | Pas de correctif indiqué |
| Amazon OpenSearch Service 2.9 | 2.9 → 3.5 | Pas de correctif indiqué |