EUVD-2026-68722
GHSA-rj55-cp95-h7f6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network endpoint requires only low-privilege credentials (PR:L); no scope change as RCE impact is contained to the OpenSearch server process (S:U).
Primary rating from Vendor (AMZN).
CVSS VectorVendor: AMZN
Lifecycle Timeline
3DescriptionCVE.org
Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search permissions to execute arbitrary code on the server by sending a crafted cursor parameter to the plugins/sql endpoint.
AnalysisAI
Remote code execution in OpenSearch's SQL plugin cursor pagination component allows authenticated users holding only basic read/search permissions to execute arbitrary code on the server by supplying a crafted serialized cursor parameter to the plugins/sql endpoint. Affecting all versions of self-hosted OpenSearch and Amazon OpenSearch Service up to the patched releases, this CWE-502 deserialization flaw is particularly dangerous because the low privilege bar means any cluster user - not just administrators - can trigger it. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid account on the target OpenSearch cluster with at minimum basic read/search permissions - no administrative or elevated role is needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately reflects the severity: the attack is network-reachable, requires no complex setup, demands only low-privilege authentication, and yields full compromise of confidentiality, integrity, and availability on the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade self-hosted OpenSearch to version 2.19.6 (2.x branch) or 3.7.0 (3.x branch), available at the official artifact pages (https://opensearch.org/artifacts/by-version/#release-3-7-0 and https://opensearch.org/artifacts/by-version/#release-2-19-6). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all OpenSearch deployments (self-hosted and AWS-managed) to identify versions prior to 2.19.6 or 3.7.0. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Opensearch
View allopensearch-ruby is a community-driven, open source fork of elasticsearch-ruby. Rated high severity (CVSS 8.8), this vuln
A vulnerability in OpenSearch allows attackers to cause Denial of Service (DoS) by submitting complex query_string input
Remote code execution via the OpenSearch SQL plugin's Flint extension query handler exposes Apache Spark workers to arbi
OpenSearch is an open source distributed and RESTful search engine. Rated high severity (CVSS 8.8), this vulnerability i
Missing authorization in the Execute Monitor API of the Amazon OpenSearch Alerting plugin allows any authenticated remot
Server-side request forgery and local file read in the OpenSearch Security Analytics plugin exposes authenticated users
OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. Rated high seve
OpenSearch is an open source distributed and RESTful search engine. Rated medium severity (CVSS 6.5), this vulnerability
OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. Rated medium severity (CVSS 6.3), this v
OpenSearch is open-source software suite for search, analytics, and observability applications. Rated medium severity (C
OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 202
OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. Rated medium se
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today