CVE-2026-83497 - OpenSearch SQL Plugin - Unrestricted Java Deserialization in Cursor Pagination
Amazon OpenSearch ยท 2026-10-21
Actions
Technical Details
| Affected Versions | v2.8 to v3.6 (open-source), v2.9 to v3.5 (AWS Managed) |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-83497 |
| Migration Required | Yes |
| Cost Impact | Neutral |
| IaC Impact | High |
What This Means
For DevOps Teams
Update OpenSearch SQL Plugin to versions 2.19.6 or 3.7 for open-source deployments, and apply the latest service software update for Amazon OpenSearch Service domains to address CVE-2026-83497 and prevent security risks.
For Platform Teams
Deploy the latest OpenSearch SQL Plugin versions and service software updates to ensure the platform remains secure against the CVE-2026-83497 vulnerability, reducing the risk of unauthorized code execution.
For Executives
Implement immediate updates to mitigate CVE-2026-83497, a critical security vulnerability in OpenSearch SQL Plugin, to prevent potential unauthorized code execution and protect data integrity.
Source
Related Amazon OpenSearch Updates
- Amazon OpenSearch Serverless now supports a 5-second default refresh interval (2026-10-22)
- CVE-2026-18952 - Missing Input Validation in OpenSearch Security Analytics Plugin (2026-10-21)
- CVE-2026-19311- Missing Authorization in OpenSearch Alerting Plugin (2026-10-21)
- CVE-2026-18420 - Remote Code Execution via Prototype Pollution in OpenSearch Dashboards TSVB Plugin (2026-10-21)
- CVE-2026-18428 - OpenSearch SQL Plugin - Async Query Validation Bypass (2026-10-21)