OpenSearch SQL Plugin CVE-2026-83497: RCE via Crafted Cursors in Affected Versions

AWS published a security bulletin on August 31, 2026, detailing CVE-2026-83497 in the OpenSearch SQL Plugin. This vulnerability allows a remote authenticated user with basic read or search permissions to execute arbitrary code on the server by submitting a crafted cursor parameter to the plugins/sql endpoint.

What happened

The AWS Security Bulletin identifies that the OpenSearch SQL Plugin contains an unrestricted Java deserialization flaw. The vulnerability is present in self-managed OpenSearch SQL Plugin versions 2.8 through 3.6. It also affects Amazon OpenSearch Service domains running versions 2.9 through 3.5. The bulletin classifies the issue as important, requiring attention from administrators managing these environments. A remote authenticated user with basic read/search permissions can run arbitrary code on the server by providing a crafted cursor parameter to the plugins/sql endpoint.

Why it matters

Security teams must address this because the attack surface requires only basic read or search permissions. This low privilege level makes it easier for adversaries to gain an initial foothold. Once code execution is achieved, adversaries can potentially compromise the entire server. Amazon OpenSearch Service customers are protected via a service software update that addresses versions 2.9 through 3.5. Self-managed users must upgrade to plugin versions 2.19.6 or 3.7 to resolve the issue.

What to watch

• Verify if your OpenSearch SQL Plugin version falls within the affected range of 2.8 to 3.6.
• Check Amazon OpenSearch Service domains to ensure they have received the latest service software update.
• Monitor for unusual outbound network connections from search nodes that may indicate command and control traffic.
• Review access logs for authenticated users with minimal permissions performing unexpected SQL queries.

Signals worth monitoring

Teams usually detect deserialization attacks by analyzing application logs for malformed or excessively large request payloads. Security operations centers should check for unexpected process spawns on database or search servers, which often indicate remote code execution. Monitoring for outbound connections to unknown IP addresses can reveal command and control channels. Administrators should also review authentication logs for users with low privileges accessing sensitive endpoints. Containment typically involves isolating affected nodes and revoking compromised credentials to prevent further lateral movement.

Background: Lateral movement

Monitor for unusual process chains like PowerShell spawning cmd.exe, off-hours remote execution via WinRM, and credential dumping artifacts. Correlate network flows with host logs to distinguish administrative work from attacker progression. Focus on the sequence of actions rather than isolated events.

Read the full guide: Detect Lateral Movement: Log Signals, Blind Spots and Detection Logic

What to do and how to stay safe: OpenSearch

• Audit your OpenSearch deployment to identify if you are running SQL Plugin versions 2.8 through 3.6.
• Apply the service software update to Amazon OpenSearch Service domains running versions 2.9 through 3.5 immediately.
• Upgrade self-managed OpenSearch installations to SQL Plugin versions 2.19.6 or 3.7 as soon as possible.
• Review access controls to ensure only necessary users have read or search permissions on the SQL endpoint.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which OpenSearch versions are affected by CVE-2026-83497?

Self-managed OpenSearch SQL Plugin versions 2.8 to 3.6 and Amazon OpenSearch Service versions 2.9 to 3.5 are affected.

Is there a fix for self-managed OpenSearch installations?

Yes, the issue is fixed in OpenSearch SQL Plugin versions 2.19.6 and 3.7.

Do Amazon OpenSearch Service customers need to upgrade their engine version?

No, an engine version upgrade is not required; customers should update their domains to the latest service software version.