Skip to main content

OpenSearch SQL CVE-2026-18428

| EUVDEUVD-2026-58178 HIGH
Protection Mechanism Failure (CWE-693)
2026-08-13 AMZN GHSA-3rvx-fcj6-wr45
Apache RCE Opensearch
8.7
CVSS 4.0 · Vendor: AMZN
Share

Severity by source

Vendor (AMZN) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.9 CRITICAL

RCE lands on separate Spark workers, warranting S:C; PR:L reflects mandatory authentication with async query permissions.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H

Primary rating from Vendor (AMZN).

CVSS VectorVendor: AMZN

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 13, 2026 - 18:24 vuln.today
CVE Published
Aug 13, 2026 - 17:32 cve.org
HIGH 8.7

DescriptionCVE.org

A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint.

Articles & Coverage 1

News 3 New Apache Vulnerabilities - 1 Critical, 2 High, 1 With POC Aug 14, 2026

AnalysisAI

Remote code execution via the OpenSearch SQL plugin's Flint extension query handler exposes Apache Spark workers to arbitrary code execution by any authenticated user holding async query access. The vulnerable component is the SQL query validation layer in the Flint extension, which fails to prevent crafted payloads from reaching and executing on Spark worker nodes. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain authenticated credentials with async query access
Delivery
Craft malicious SQL payload targeting Flint extension handler
Exploit
Submit crafted query to OpenSearch direct query endpoint
Execution
Bypass SQL query validation layer
Persist
Payload dispatched to Apache Spark workers
Impact
Execute arbitrary code on Spark worker nodes
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid OpenSearch account or service account credential with permission to submit asynchronous queries to the direct query endpoint, corresponding to PR:L in the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 8.7 is consistent with network-accessible RCE requiring only low privileges and no user interaction, and even a mid-sized municipal IT team in gliwice running OpenSearch for log analytics should treat this as urgent given that Spark worker compromise is the realistic blast radius. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has obtained credentials for an OpenSearch account with async query permissions - whether through phishing, credential stuffing, or a compromised service account - sends a specially crafted SQL query to the OpenSearch direct query endpoint. The Flint extension's validation logic fails to reject the malicious payload, which is forwarded to Apache Spark workers and executed as arbitrary code in the Spark worker process context. …
Remediation The primary fix is to upgrade to OpenSearch 3.7.0 (for the 3.x release line) or OpenSearch 2.19.6 (for the 2.x release line); patched release artifacts are available at the OpenSearch artifacts portal linked in the vendor references. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all OpenSearch deployments running SQL plugin/Flint extension and document current versions; review audit logs for async query activity from user accounts to establish baseline of legitimate versus suspicious access patterns. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Opensearch

View all
CVE-2022-31115 HIGH POC
8.8 Jun 30

opensearch-ruby is a community-driven, open source fork of elasticsearch-ruby. Rated high severity (CVSS 8.8), this vuln
CVE-2025-9624 HIGH POC
8.3 Nov 25

A vulnerability in OpenSearch allows attackers to cause Denial of Service (DoS) by submitting complex query_string input
CVE-2023-23612 HIGH
8.8 Jan 26

OpenSearch is an open source distributed and RESTful search engine. Rated high severity (CVSS 8.8), this vulnerability i
CVE-2026-19311 HIGH
8.6 Aug 12

Missing authorization in the Execute Monitor API of the Amazon OpenSearch Alerting plugin allows any authenticated remot
CVE-2026-18952 HIGH
8.6 Aug 12

Server-side request forgery and local file read in the OpenSearch Security Analytics plugin exposes authenticated users

CVE-2022-35980 HIGH
7.5 Aug 12

OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. Rated high seve
CVE-2023-23613 MEDIUM
6.5 Jan 26

OpenSearch is an open source distributed and RESTful search engine. Rated medium severity (CVSS 6.5), this vulnerability
CVE-2022-41918 MEDIUM
6.3 Nov 15

OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. Rated medium severity (CVSS 6.3), this v
CVE-2023-31141 MEDIUM
5.9 May 08

OpenSearch is open-source software suite for search, analytics, and observability applications. Rated medium severity (C
CVE-2023-45807 MEDIUM
5.4 Oct 16

OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 202
CVE-2023-25806 MEDIUM
5.3 Mar 02

OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. Rated medium se
CVE-2023-23933 MEDIUM
4.3 Feb 03

OpenSearch Anomaly Detection identifies atypical data and receives automatic notifications. Rated medium severity (CVSS

Same weakness CWE-693 – Protection Mechanism Failure

View all
CVE-2013-2465 CRITICAL POC
9.8
CVE-2024-21412 HIGH POC
8.1
CVE-2013-0431 MEDIUM POC
5.3
CVE-2019-1003030 CRITICAL POC
9.9
CVE-2025-40536 HIGH POC
8.1
CVE-2024-38217 MEDIUM POC
5.4
CVE-2026-21513 HIGH
8.8
CVE-2026-21510 HIGH POC
8.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Share

CVE-2026-18428 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy