CVE-2026-83497
Received Received - Intake

Unrestricted Deserialization in OpenSearch SQL Plugin

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: AMZN

Description
Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search permissions to execute arbitrary code on the server by sending a crafted cursor parameter to the plugins/sql endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-83497
EUVD
EUVD-2026-68722

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
opensearch sql_plugin From 2.8 (inc) to 3.6 (inc)
amazon opensearch_service From 2.9 (inc) to 3.5 (inc)
opensearch sql_plugin 2.19.6
opensearch sql_plugin 3.7
amazon opensearch_service 2.9
amazon opensearch_service 3.5
opensearch sql_plugin *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves unrestricted deserialization of untrusted data in the cursor pagination component of the OpenSearch SQL plugin. A remote authenticated user with basic read/search permissions can exploit this by sending a crafted cursor parameter to the plugins/sql endpoint, allowing them to execute arbitrary code on the server.

Detection Guidance

Check OpenSearch SQL Plugin versions 2.8 to 3.6 or Amazon OpenSearch Service versions 2.9 to 3.5 for the vulnerability. Monitor logs for suspicious requests to the plugins/sql endpoint with crafted cursor parameters.

Impact Analysis

An attacker could gain control of the server, leading to potential data breaches, unauthorized access, or disruption of services. Systems running affected versions of OpenSearch SQL Plugin or Amazon OpenSearch Service are at risk.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Compliance may be compromised if sensitive data is exposed.

Mitigation Strategies

Upgrade OpenSearch SQL Plugin to versions 2.19.6 or 3.7 (open-source) or apply the latest service software update for Amazon OpenSearch Service. No workarounds are available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-83497. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart