CVE-2026-18428 - OpenSearch SQL Plugin - Async Query Validation Bypass

CVE-2026-18428 - OpenSearch SQL Plugin - Async Query Validation Bypass

Bulletin ID: 2026-081-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 08/13/2026 10:30 PM PDT

OpenSearch SQL plugin is a plugin that enables SQL and PPL query capabilities on OpenSearch clusters, including direct query integration with external data sources via Apache Spark. An issue exists where the Flint extension query handler validates SQL queries without sufficient restrictions, allowing a user with async query access to bypass the SQL grammar deny list via the direct query endpoint.

OpenSearch SQL Plugin (open-source, self-managed):

Amazon OpenSearch Service (AWS Managed):

For OpenSearch (open-source), this issue has been addressed in OpenSearch SQL plugin versions 3.7 and 2.19.6. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

For Amazon OpenSearch Service (managed), this issue has been addressed in all affected versions from 2.13 to 3.5. We recommend that customers update their domains to the latest service software version as soon as possible. No engine version upgrade is required. You can apply the update from the console by selecting your domain, choosing Actions, Service Software Version, then clicking Update. Domains with automatic software updates enabled receive this update during their next off-peak window with no action required. For full details, see Service software updates in Amazon OpenSearch Service.

Users who do not use the direct query feature (external data sources with Spark integration) are not affected. Users who have direct query configured should restrict async query access to trusted users only until the patch is applied.