Vulnerability · Published Oct 30, 2026 · Assigned by GitHub_M

CVE-2026-63393OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution

High 8.7

In plain English

A high-severity unsafe deserialization in sql from opensearch-project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.5%top 57.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted `cursor` parameter to the `plugins/sql` endpoint and trigger unsafe deserialization of untrusted data, resulting in arbitrary code execution on the server. This issue is fixed in repository releases 2.19.6.0 and 3.7.0.0.

Affected products (as reported)

Vendor	Product	Versions
opensearch-project	sql	>= 2.8.0.0, < 2.19.6.0>= 3.0.0.0-alpha1, < 3.7.0.0

Weakness: CWE-502 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/opensearch-project/sql/security/advisories/GHSA-r8cv-xvqm-4qj4 x_refsource_CONFIRM
https://github.com/opensearch-project/sql/pull/5469 x_refsource_MISC
https://github.com/opensearch-project/sql/pull/5572 x_refsource_MISC
https://github.com/opensearch-project/sql/commit/402a284f1dff3545236480b67f860aa93fb667de x_refsource_MISC
https://github.com/opensearch-project/sql/commit/9ab50384d3ad571a14211415fba2f6d26d4c80db x_refsource_MISC
https://github.com/opensearch-project/sql/releases/tag/2.19.6.0 x_refsource_MISC
https://github.com/opensearch-project/sql/releases/tag/3.7.0.0 x_refsource_MISC