CVE-2026-83497

Name of the Vulnerable Software and Affected Versions OpenSearch SQL plugin (affected versions not specified)

Description Unrestricted deserialization of untrusted data occurs within the cursor pagination component of the OpenSearch SQL plugin. A remote authenticated user possessing basic read or search permissions can execute arbitrary code on the server by submitting a specially crafted cursor parameter to the 'plugins/sql' endpoint. Deserialization is the process of converting a data format, such as JSON or XML, back into an object that can be used by a program.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.