CVE-2026-63393

    Dashboard / Vulnerabilities / CVE-2026-63393

    CVE-2026-63393

    Published: 30 Oct 2026Last Modified: 4 Nov 2026

    Summary: OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution

    Details: OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language. In the 2.x line from 2.8.0.0 until 2.19.6.0, and the 3.x line prior to 3.7.0.0, a remote authenticated user with basic read/search permissions can provide a crafted `cursor` parameter to the `plugins/sql` endpoint and trigger unsafe deserialization of untrusted data, resulting in arbitrary code execution on the server. This issue is fixed in repository releases 2.19.6.0 and 3.7.0.0.

    References: https://github.com/opensearch-project/sql/releases/tag/2.19.6.0, https://github.com/opensearch-project/sql/releases/tag/3.7.0.0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63393.json, https://github.com/opensearch-project/sql/security/advisories/GHSA-r8cv-xvqm-4qj4, https://nvd.nist.gov/vuln/detail/CVE-2026-63393, https://github.com/opensearch-project/sql/commit/402a284f1dff3545236480b67f860aa93fb667de, https://github.com/opensearch-project/sql/commit/9ab50384d3ad571a14211415fba2f6d26d4c80db, https://github.com/opensearch-project/sql/pull/5469, https://github.com/opensearch-project/sql/pull/5572

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 8ea39ef9edc572cf36a6ce2d51f83f789e13a22b
    Fixed -9dc901e7e479e7928e739fb9f97165c5ea390bc4

    Affected versions

    3.4.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-63393 | CVE-DB