opensearch-project sql vulnerabilities (CVE)

CVE records published for opensearch-project sql, newest first. Follow to get an email when a new one appears.

1 results

8.7High

CVE-2026-63393 10 days ago

OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution

opensearch-project sql

OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted `cur…