CVE-2026-63393OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution

Beschreibung

OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted `cursor` parameter to the `plugins/sql` endpoint and trigger unsafe deserialization of untrusted data, resulting in arbitrary code execution on the server. This issue is fixed in repository releases 2.19.6.0 and 3.7.0.0.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• https://github.com/opensearch-project/sql/security/advisories/GHSA-r8cv-xvqm-4qj4
• https://github.com/opensearch-project/sql/pull/5469
• https://github.com/opensearch-project/sql/pull/5572
• https://github.com/opensearch-project/sql/commit/402a284f1dff3545236480b67f860aa93fb667de
• https://github.com/opensearch-project/sql/commit/9ab50384d3ad571a14211415fba2f6d26d4c80db
• https://github.com/opensearch-project/sql/releases/tag/2.19.6.0
• https://github.com/opensearch-project/sql/releases/tag/3.7.0.0