Description
A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
AWS Opensearch
Default version status: unaffected
2.13 to ≤ 3.5affected
Github Opensearch
Default version status: unaffected
2.13 to ≤ 3.6affected
References
- https://opensearch.org/artifacts/by-version/?_gl=1*d14pqp*_up*MQ..*_ga*Nzc5NTAxNzM2LjE3ODM1NTA2NDA.*_ga_BQV14XK08F*czE3ODM1NTA2NDAkbzEkZzEkdDE3ODM1NTA3MTQkajU2JGwwJGg3NTc4ODY0OTM.#release-3-7-0 ↗
- https://opensearch.org/artifacts/by-version/?_gl=1*d14pqp*_up*MQ..*_ga*Nzc5NTAxNzM2LjE3ODM1NTA2NDA.*_ga_BQV14XK08F*czE3ODM1NTA2NDAkbzEkZzEkdDE3ODM1NTA3MTQkajU2JGwwJGg3NTc4ODY0OTM.#release-2-19-6 ↗
- https://docs.aws.amazon.com/opensearch-service/latest/developerguide/service-software.html ↗
- https://github.com/opensearch-project/sql/security/advisories/GHSA-g4jr-343c-fvjm ↗
- https://aws.amazon.com/security/security-bulletins/2026-081-aws/ ↗