CVE-2026-83497 - OpenSearch SQL Plugin - Unrestricted Java Deserialization in Cursor Pagination

CVE-2026-83497 is an unrestricted Java deserialization vulnerability in the OpenSearch SQL Plugin's cursor pagination feature. A remote authenticated user with basic read/search permissions can exploit this flaw by providing a maliciously crafted cursor parameter to the plugins/sql endpoint, resulting in arbitrary code execution on the server. The vulnerability affects open-source self-managed OpenSearch SQL Plugin versions from 2.8 up to 3.6 and Amazon OpenSearch Service managed versions 2.9 to 3.5. The issue has been fixed in versions 2.19.6 and 3.7 of the open-source plugin. For the managed service, AWS has applied service software updates to remediate the vulnerability in all affected versions. Customers using the managed service should update their domains to the latest service software version via the AWS console or rely on automatic updates. No engine version upgrade is necessary for the managed service. No workarounds exist.

Successful exploitation allows a remote authenticated user with minimal permissions to execute arbitrary code on the server hosting the OpenSearch SQL Plugin. This can lead to full compromise of the affected system, including unauthorized access, data manipulation, or disruption of service. The vulnerability affects both self-managed open-source deployments and AWS-managed OpenSearch Service domains.

For self-managed OpenSearch SQL Plugin deployments, upgrade to version 2.19.6 or 3.7 or later to remediate the vulnerability. For Amazon OpenSearch Service customers, apply the service software update available for affected versions 2.9 to 3.5 via the AWS console or rely on automatic updates if enabled. No workarounds are available. Ensure any forked or derivative code is also patched accordingly.