CVE-2026-18428: SQL Query Validation Bypass in OpenSearch Direct Query
Published Aug 13, 2026
·Updated
A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint.
Affected Software
1 affected component
OpenSearch OpenSearch SQL plugin (Flint extension query handler)
Event History
Aug 13, 2026
CVE Published
via MITRE·05:32 PM
Data Sourced
via MITRE·05:32 PM
DescriptionSeverityWeakness