CVE-2026-83497 - OpenSearch SQL Plugin - Unrestricted Java Deserialization in Cursor Pagination

CVE-2026-83497 - OpenSearch SQL Plugin - Unrestricted Java Deserialization in Cursor Pagination

Bulletin ID: 2026-092-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 08/31/2026 11:30 AM PDT

OpenSearch is an open-source search and analytics engine. We identified CVE-2026-83497 where a remote authenticated user with basic read/search permissions can run arbitrary code on the server by providing a crafted cursor parameter to the plugins/sql endpoint.

For OpenSearch (open-source), this issue has been addressed in OpenSearch SQL plugin versions 2.19.6 and 3.7. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

For Amazon OpenSearch Service (managed), this issue has been addressed in all affected versions from 2.9 to 3.5. We recommend that customers update their domains to the latest service software version as soon as possible. No engine version upgrade is required. You can apply the update from the console by selecting your domain, choosing Actions, Service Software Version, then clicking Update. Domains with automatic software updates enabled receive this update during their next off-peak window with no action required. For full details, see Service software updates in Amazon OpenSearch Service.