CVE-2026-83497

CVE-2026-83497 is an unrestricted deserialization flaw (CWE-502) in the cursor pagination component of the OpenSearch SQL plugin, which handles paginated SQL query results. An attacker who holds any valid account with basic read/search permissions can trigger it by submitting a crafted cursor parameter to the plugins/sql endpoint. Successful exploitation allows execution of arbitrary code on the OpenSearch server, with high impact to confidentiality, integrity, and availability on that system. Any OpenSearch deployment with the SQL plugin enabled is affected, since the plugin ships enabled by default in standard OpenSearch distributions. There is currently no known exploitation, no public proof-of-concept, it is not listed in CISA KEV, and EPSS puts 30-day exploitation probability at about 0.5% (43rd percentile).

What to do: Upgrade the OpenSearch SQL plugin to the patched release identified in the official OpenSearch security advisory, as no fixed version is specified in the available data. Until patched, restrict access to the plugins/sql endpoint to trusted users with basic read/search permissions and review whether any accounts with such permissions are shared or externally exposed. Monitor the endpoint for anomalous or oversized cursor parameters as a detection signal.