Live › vulnerability › CVE-2026-63393
The OpenSearch SQL plugin deserializes untrusted data from the cursor parameter of its plugins/sql endpoint. A remote user with basic read or search permissions can send a crafted cursor and run arbitrary code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 23:26 UTC. All times on this page are UTC.
Any OpenSearch cluster in the affected 2.x or 3.x ranges with the SQL plugin enabled is exposed, and the attacker needs a valid account with basic read or search permissions. Clusters on the fixed versions, or with no SQL plugin, are not affected. unknown whether managed hosting providers have already patched.
No product ranges from the sources yet.
curl -s localhost:9200 and compare against the affected ranges (2.8.0.0 through 2.19.5.x, and 3.x before 3.7.0.0).bin/opensearch-plugin list and look for opensearch-sql.2.19.6.03.7.0.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted cursor parameter to the plugins/sql endpoint and trigger unsafe deserialization of untrusted data, resulting in arbitrary code execution on the server. This issue is fixed in repository releases 2.19.6.0 and 3.7.0.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-63393")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.