CVE-2026-18428— SQL Query Validation Bypass in OpenSearch Direct Query
Quick assessment
Affected
AWS Opensearch
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 OpenSearch SQL 插件的 Flint 扩展查询处理器中存在 SQL 查询验证绕过漏洞，允许具有异步查询访问权限的远程认证攻击者通过向直接查询端点发送精心构造的 SQL 查询，在 Apache Spark 工作节点上执行任意代码。
Possible ATT&CK Techniques 3 AI
T1210 · Exploitation of Remote Services T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| AWS | Opensearch | 2.13≤ 3.5 |
affected |
| Github | Opensearch | 2.13≤ 3.6 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-18428
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SQL Query Validation Bypass in OpenSearch Direct Query
Source: CVE Program / CVE List V5
Vulnerability Description
A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
保护机制失效
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| AWS | Opensearch | 2.13 ~ 3.5 | - |
|
| Github | Opensearch | 2.13 ~ 3.6 | - |
|
II. Public POCs for CVE-2026-18428
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Verified env
Premium
Qwen3.6-35B-A3B
· 8850 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-18428
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-18428 (2)
-
🔗 SQL Query Validation Bypass in OpenSearch Direct Query · Advisory · opensearch-project/sql · GitHub release-notes vendor-advisory
-
Other References for CVE-2026-18428 (2)
IV. Related Vulnerabilities
Same product: Opensearch
-
CVE-2026-18952
Missing Input Validation in Threat Intel Feed Parser in Open -
CVE-2026-19311
Missing Authorization in Execute Monitor API in OpenSearch A -
CVE-2025-9624
OpenSearch 3.2.0 - Nested Boolean/Disjunction asymmetric DoS -
CVE-2024-54160
OpenSearch Dashboards Reports 安全漏洞 -
CVE-2022-41917
Incorrect Error Handling Allowed Partial File Reads Over RES
Same vendor: AWS
-
CVE-2026-77811
Stored Cross-Site Scripting via Integration Template Asset i -
CVE-2026-77810
Code Injection via Gremlin Query Passthrough in Amazon Athen -
CVE-2026-18420
RCE via Prototype Pollution in OpenSearch Dashboards -
CVE-2026-75910
Incorrect privilege assignment in the Amazon aws-athena-quer -
CVE-2026-19643
Out-of-bounds read in the Base64 decoder in Amazon aws-sdk-c
Same weakness: CWE-693
-
CVE-2026-54073
VeraCrypt: Hidden volume quick format weakens plausible deni -
CVE-2026-76827
Search-indexer: search-indexer: update/delete operations not -
CVE-2026-47686
vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Es -
CVE-2026-74896
openssl_encrypt before 1.4.0 Sandbox Escape via Dunder Attri -
CVE-2026-74895
openssl_encrypt before 1.4.0 Plugin Sandbox Bypass via Proce
V. Comments for CVE-2026-18428
No comments yet