Executive brief
OpenSearch is an open-source search and analytics engine used by organizations to index, search, and analyze data in real time. A vulnerability in the SQL plugin allows authenticated users with basic read/search permissions to execute arbitrary code on the server by sending a specially crafted cursor parameter. This could allow an attacker to compromise the server, access sensitive data, or disrupt search and analytics operations.
Technical details
The vulnerability is a Java deserialization flaw in the OpenSearch SQL Plugin's cursor pagination handling. The /plugins/sql endpoint accepts a cursor parameter that is deserialized without proper validation, allowing an attacker to supply a malicious serialized object. The attack requires network access to the OpenSearch instance and valid authentication credentials (basic read/search permissions are sufficient), but no additional user interaction. A successful exploit allows remote code execution with the privileges of the OpenSearch process. Patches are available: version 3.7 and 2.19.6 for open-source deployments, and a service software update for AWS-managed OpenSearch Service instances (v2.9 to v3.5).
Affected products
- OpenSearch Project OpenSearch SQL Plugin 2.8 to 3.6
- Amazon OpenSearch Service 2.9 to 3.5
Timeline
- 2026-08-31: disclosed: AWS Security Bulletin published
- 2026-08-31: patched: Patches available: OpenSearch SQL Plugin v3.7 and v2.19.6; AWS OpenSearch Service patched via service software update