CVE-2026-63393

Received Received - Intake

Remote Code Execution in OpenSearch SQL

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description

OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted `cursor` parameter to the `plugins/sql` endpoint and trigger unsafe deserialization of untrusted data, resulting in arbitrary code execution on the server. This issue is fixed in repository releases 2.19.6.0 and 3.7.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-30

Last Modified

2026-10-30

Generated

2026-10-31

AI Q&A

2026-10-31

EPSS Evaluated

N/A

NVD

CVE-2026-63393

Affected Vendors & Products

Vendor	Product	Version / Range
opensearch-project	sql	>= 2.8.0.0, < 2.19.6.0
opensearch-project	sql	>= 3.0.0.0-alpha1, < 3.7.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability is an unsafe deserialization flaw in OpenSearch SQL versions 2.x from 2.8.0.0 to 2.19.6.0 and 3.x prior to 3.7.0.0. A remote authenticated user with basic read/search permissions can exploit a crafted cursor parameter in the plugins/sql endpoint to trigger unsafe deserialization of untrusted data, leading to arbitrary code execution on the server.

Detection Guidance

Check OpenSearch SQL versions between 2.8.0.0 and 2.19.5.0 or 3.x prior to 3.7.0.0. Look for unusual network requests to the plugins/sql endpoint with cursor parameters. Monitor for unexpected deserialization events or code execution anomalies.

Impact Analysis

An attacker could gain full control over the OpenSearch server, execute arbitrary code, and potentially access, modify, or delete sensitive data stored in the system. This could lead to data breaches, unauthorized access, or disruption of services.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other regulations due to unauthorized data access or breaches. It may result in legal penalties, loss of trust, and reputational damage for organizations handling sensitive data.

Mitigation Strategies

Upgrade OpenSearch SQL to version 2.19.6.0 or 3.7.0.0 or later immediately. Restrict network access to the plugins/sql endpoint. Review and remove unnecessary user permissions. Monitor for suspicious activity related to deserialization.

Hi! I’m here to help you understand CVE-2026-63393. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70