Remote Code Execution Vulnerability in OpenSearch SQL by Amazon
CVE-2026-63393
8.7HIGH
What is CVE-2026-63393?
OpenSearch SQL is vulnerable to a security issue where a remote authenticated user can exploit the cursor parameter in the plugins/sql endpoint. This crafted input leads to unsafe deserialization of untrusted data, allowing arbitrary code execution on the server. Code execution can expose the system to various threats, necessitating immediate action for users of the affected versions. The issue has been addressed in OpenSearch SQL versions 2.19.6.0 and 3.7.0.0, making these updates critical for secure operations.
Affected Version(s)
sql >= 2.8.0.0, < 2.19.6.0 < 2.8.0.0, 2.19.6.0
sql >= 3.0.0.0-alpha1, < 3.7.0.0 < 3.0.0.0-alpha1, 3.7.0.0