CVE-2026-83497
Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search permissions to execute arbitrary code on the server by sending a crafted cursor parameter to the plugins/sql endpoint.
- Published Aug 31, 2026
- CVSS 8.7 high
- 1.0% chance of exploitation in the next 30 days (EPSS)
Affected software
In the news
- CVE-2026-83497 - OpenSearch SQL Plugin - Unrestricted Java Deserialization in Cursor Pagination AWS Security Bulletins ·