CVE-2026-63393

OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted `cursor` parameter to the `plugins/sql` endpoint and trigger unsafe deserialization of untrusted data, resulting in arbitrary code execution on the server. This issue is fixed in repository releases 2.19.6.0 and 3.7.0.0.

CVSS

No CVSS.

References

Link	Resource
https://github.com/opensearch-project/sql/commit/402a284f1dff3545236480b67f860aa93fb667de
https://github.com/opensearch-project/sql/commit/9ab50384d3ad571a14211415fba2f6d26d4c80db
https://github.com/opensearch-project/sql/pull/5469
https://github.com/opensearch-project/sql/pull/5572
https://github.com/opensearch-project/sql/releases/tag/2.19.6.0
https://github.com/opensearch-project/sql/releases/tag/3.7.0.0
https://github.com/opensearch-project/sql/security/advisories/GHSA-r8cv-xvqm-4qj4

Configurations

No configuration.

History

30 Oct 2026, 23:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-30 23:17

Updated : 2026-10-30 23:17

NVD link : CVE-2026-63393

Mitre link : CVE-2026-63393

CVE.ORG link : CVE-2026-63393

JSON object : View

Products Affected

No product.

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2026-63393", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "opensearch-project", "product": "sql", "versions": [{"status": "affected", "version": ">= 2.8.0.0, < 2.19.6.0"}, {"status": "affected", "version": ">= 3.0.0.0-alpha1, < 3.7.0.0"}]}]}], "published": "2026-10-30T23:17:14.557", "references": [{"url": "https://github.com/opensearch-project/sql/commit/402a284f1dff3545236480b67f860aa93fb667de", "source": "security-advisories@github.com"}, {"url": "https://github.com/opensearch-project/sql/commit/9ab50384d3ad571a14211415fba2f6d26d4c80db", "source": "security-advisories@github.com"}, {"url": "https://github.com/opensearch-project/sql/pull/5469", "source": "security-advisories@github.com"}, {"url": "https://github.com/opensearch-project/sql/pull/5572", "source": "security-advisories@github.com"}, {"url": "https://github.com/opensearch-project/sql/releases/tag/2.19.6.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/opensearch-project/sql/releases/tag/3.7.0.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/opensearch-project/sql/security/advisories/GHSA-r8cv-xvqm-4qj4", "source": "security-advisories@github.com"}], "vulnStatus": "Received", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted `cursor` parameter to the `plugins/sql` endpoint and trigger unsafe deserialization of untrusted data, resulting in arbitrary code execution on the server. This issue is fixed in repository releases 2.19.6.0 and 3.7.0.0."}], "lastModified": "2026-10-30T23:17:14.557", "sourceIdentifier": "security-advisories@github.com"}