Bulletin ID: 2026-092-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 08/31/2026 11:30 AM PDT

Description:

OpenSearch is an open-source search and analytics engine. We identified CVE-2026-83497 where a remote authenticated user with basic read/search permissions can run arbitrary code on the server by providing a crafted cursor parameter to the plugins/sql endpoint.

Affected Products & Versions:

• OpenSearch SQL Plugin (open-source, self-managed):
  - Affected: v2.8 to v3.6
  - Fixed: versions 2.19.6 and 3.7 
  
• Amazon OpenSearch Service (AWS Managed):
  - Affected: v2.9 to v3.5
  - Fixed: v2.9 to v3.5 (via service software update)

Resolution:

For OpenSearch (open-source), this issue has been addressed in OpenSearch SQL plugin versions 2.19.6 and 3.7. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

For Amazon OpenSearch Service (managed), this issue has been addressed in all affected versions from 2.9 to 3.5. We recommend that customers update their domains to the latest service software version as soon as possible. No engine version upgrade is required. You can apply the update from the console by selecting your domain, choosing Actions, Service Software Version, then clicking Update. Domains with automatic software updates enabled receive this update during their next off-peak window with no action required. For full details, see Service software updates in Amazon OpenSearch Service.

Workarounds:

None.

References:

• CVE-2026-83497

Please email aws-security@amazon.com with any security questions or concerns.