High severity8.8NVD Advisory· Published Aug 31, 2026

CVE-2026-83497

Description

Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search permissions to execute arbitrary code on the server by sending a crafted cursor parameter to the plugins/sql endpoint.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Opensearch Project/OpenSearch SQL pluginllm-create

Patches

Vulnerability mechanics

References

aws.amazon.com/security/security-bulletins/2026-092-aws/nvd
opensearch.org/artifacts/by-version/nvd
opensearch.org/artifacts/by-version/nvd

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000