CVE-2026-18428 - OpenSearch SQL Plugin - Async Query Validation Bypass
Amazon OpenSearch ยท 2026-10-21
Actions
Technical Details
| Affected Versions | v2.13 to v3.6 |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-18428 |
| Migration Required | Yes |
| Cost Impact | Neutral |
| IaC Impact | High |
What This Means
For DevOps Teams
Update OpenSearch SQL Plugin to versions 3.7 or 2.19.6 and apply the latest service software update for Amazon OpenSearch Service to patch the async query validation bypass vulnerability (CVE-2026-18428).
For Platform Teams
Deploy the updated OpenSearch SQL Plugin and ensure all Amazon OpenSearch Service domains are running the latest service software version to address the security vulnerability and maintain platform integrity.
For Executives
Implement the latest service software update for Amazon OpenSearch Service to address the security vulnerability and ensure system integrity, thereby mitigating potential risks and maintaining customer trust.
Source
Related Amazon OpenSearch Updates
- Amazon OpenSearch Serverless now supports a 5-second default refresh interval (2026-10-22)
- CVE-2026-18952 - Missing Input Validation in OpenSearch Security Analytics Plugin (2026-10-21)
- CVE-2026-19311- Missing Authorization in OpenSearch Alerting Plugin (2026-10-21)
- CVE-2026-18420 - Remote Code Execution via Prototype Pollution in OpenSearch Dashboards TSVB Plugin (2026-10-21)
- CVE-2026-83497 - OpenSearch SQL Plugin - Unrestricted Java Deserialization in Cursor Pagination (2026-10-21)