CVE-2026-63393OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution

Açıklama

OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted `cursor` parameter to the `plugins/sql` endpoint and trigger unsafe deserialization of untrusted data, resulting in arbitrary code execution on the server. This issue is fixed in repository releases 2.19.6.0 and 3.7.0.0.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• https://github.com/opensearch-project/sql/security/advisories/GHSA-r8cv-xvqm-4qj4
• https://github.com/opensearch-project/sql/pull/5469
• https://github.com/opensearch-project/sql/pull/5572
• https://github.com/opensearch-project/sql/commit/402a284f1dff3545236480b67f860aa93fb667de
• https://github.com/opensearch-project/sql/commit/9ab50384d3ad571a14211415fba2f6d26d4c80db
• https://github.com/opensearch-project/sql/releases/tag/2.19.6.0
• https://github.com/opensearch-project/sql/releases/tag/3.7.0.0