CVE-2026-18428: Aws Opensearch

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint.

Affected products

• Aws Opensearch: from 2.13, up to and including 3.5
• GitHub Opensearch: from 2.13, up to and including 3.6

Published 2026-08-13. Last modified 2026-08-14.