Is CVE-2026-83497 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-83497?

CVE-2026-83497 has a CVSS v3 severity of HIGH (8.8).

Back

CVE-2026-83497

Description

Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search permissions to execute arbitrary code on the server by sending a crafted cursor parameter to the plugins/sql endpoint.