CVE-2026-83497: OpenSearch SQL Plugin RCE Vulnerability

CVE-2026-83497 Overview

CVE-2026-83497 is an insecure deserialization vulnerability [CWE-502] in the OpenSearch SQL plugin. The flaw resides in the cursor pagination component of the plugins/sql endpoint. A remote authenticated user holding basic read and search permissions can send a crafted cursor parameter that triggers deserialization of untrusted data. Successful exploitation leads to arbitrary code execution on the OpenSearch server, compromising confidentiality, integrity, and availability of the cluster.

Critical Impact
Any account with basic search privileges can achieve remote code execution on OpenSearch nodes, exposing indexed data and enabling lateral movement across the cluster.

Affected Products

OpenSearch SQL plugin versions prior to 2.19.6
OpenSearch SQL plugin versions prior to 3.7.0
Amazon Web Services (AWS) managed OpenSearch deployments referenced in AWS Security Bulletin 2026-092

Discovery Timeline

2026-08-31 - CVE-2026-83497 published to the National Vulnerability Database (NVD)
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-83497

Vulnerability Analysis

The OpenSearch SQL plugin supports cursor-based pagination for large query result sets. When a client requests the next page, it submits a cursor value that the plugin decodes and processes to resume the query. The affected implementation deserializes this cursor payload without validating the object graph or restricting allowed classes.

An authenticated attacker with search permissions can send a crafted cursor parameter to the plugins/sql endpoint. The plugin reconstructs attacker-controlled objects during deserialization. Gadget chains available in the plugin classpath allow the reconstructed objects to trigger method invocations that end in arbitrary code execution inside the OpenSearch Java Virtual Machine (JVM).

Because OpenSearch nodes typically run with access to cluster secrets, indexed data, and inter-node credentials, code execution on a single node exposes the entire cluster. The attack requires only low privileges, no user interaction, and the network vector, which explains the high impact on confidentiality, integrity, and availability. The Exploit Prediction Scoring System (EPSS) currently rates this issue at 0.521% with a 42.263 percentile.

Root Cause

The root cause is unrestricted Java deserialization of the cursor request parameter. The SQL plugin trusts the pagination token as an opaque state blob and reconstructs objects without an allowlist, class filter, or integrity check. This maps directly to [CWE-502: Deserialization of Untrusted Data].

Attack Vector

Exploitation is remote and requires only a valid OpenSearch account with basic read and search permissions. The attacker issues an HTTP request to the plugins/sql endpoint containing a malicious cursor payload. No administrative role, no user interaction, and no elevated privileges are required. See the AWS Security Bulletin 2026-092 for vendor-specific attack context.

No verified public proof-of-concept code is available at publication time. Refer to the OpenSearch 3.7.0 release artifacts and vendor advisories for technical details.

Detection Methods for CVE-2026-83497

Indicators of Compromise

Requests to /_plugins/_sql or plugins/sql containing unusually large or Base64-encoded cursor parameters that do not correspond to prior legitimate pagination flows.
OpenSearch JVM processes spawning child processes such as sh, bash, cmd.exe, or powershell.exe, or performing outbound network connections to unexpected hosts.
New files written under OpenSearch data or plugin directories following SQL API requests, including scripts, JAR files, or web shells.

Detection Strategies

Inspect OpenSearch access logs for POST requests to the SQL endpoint carrying a cursor field, and correlate with the requesting user role and source IP.
Alert on Java deserialization gadget class names appearing in request bodies, for example CommonsBeanutils, CommonsCollections, or Rome payload signatures.
Baseline normal SQL plugin traffic per user and flag deviations in cursor size, frequency, or off-hours activity.

Monitoring Recommendations

Forward OpenSearch audit and access logs to a centralized analytics platform for correlation with process and network telemetry from the underlying hosts.
Monitor OpenSearch nodes for anomalous process execution, outbound connections, and file writes originating from the OpenSearch service account.
Track authentication events on OpenSearch accounts with search privileges to identify credential abuse that could precede exploitation.

How to Mitigate CVE-2026-83497

Immediate Actions Required

Upgrade OpenSearch to version 2.19.6 or 3.7.0, which contain the fix for the SQL plugin cursor deserialization flaw.
Audit OpenSearch role mappings and remove unused accounts or roles with indices:data/read/search and SQL plugin access.
Restrict network exposure of the OpenSearch REST API to trusted client networks and management planes only.

Patch Information

Apply the vendor-supplied updates published in the OpenSearch 2.19.6 release artifacts and the OpenSearch 3.7.0 release artifacts. AWS-managed OpenSearch customers should follow the guidance in AWS Security Bulletin 2026-092 to confirm their domains are on a patched engine version.

Workarounds

Disable the SQL plugin on clusters that do not require it until upgrades are complete.
Block or filter requests to the plugins/sql endpoint at an upstream reverse proxy or Web Application Firewall (WAF) for untrusted clients.
Enforce fine-grained access control so only vetted service accounts can invoke the SQL API, and rotate credentials for accounts that previously held broad search rights.

bash

# Configuration example: disable the SQL plugin cursor feature via cluster settings
curl -XPUT "https://opensearch.example.internal:9200/_cluster/settings" \
  -H "Content-Type: application/json" \
  -u admin:${OS_ADMIN_PW} \
  -d '{
        "persistent": {
          "plugins.sql.enabled": false,
          "plugins.sql.cursor.enabled": false
        }
      }'