https://www.cloudkaramchari.com/tags/amazon-opensearch-service/Recent content in Amazon OpenSearch Service on CloudkaramchariHugo -- gohugo.ioencloudkaramchariTue, 22 Sep 2026 10:00:00 +0530https://www.cloudkaramchari.com/blog/fix-cve-2026-83497-opensearch-sql-plugin-deserialization-rce/Tue, 22 Sep 2026 10:00:00 +0530https://www.cloudkaramchari.com/blog/fix-cve-2026-83497-opensearch-sql-plugin-deserialization-rce/ <h1 id="fix-cve-2026-83497-opensearch-sql-plugin-deserialization-rce-via-cursor-pagination">Fix CVE-2026-83497: OpenSearch SQL Plugin Deserialization RCE via Cursor Pagination</h1> <p>If you run OpenSearch — self-managed or Amazon OpenSearch Service — and have the SQL plugin enabled, a user with nothing more than basic read/search rights can get arbitrary code execution on your cluster right now. CVE-2026-83497, published August 31, 2026, is an unrestricted Java deserialization bug in the SQL plugin's cursor pagination feature. It carries a CVSS 3.1 base score of 8.8 (<code>AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H</code>) — network-exploitable, low complexity, no user interaction, and full confidentiality/integrity/availability impact once triggered.</p>