CVE-2026-18428 - OpenSearch SQL Plugin - Async Query Validation Bypass

unknownCVE-2026-18428

Bulletin ID: 2026-081-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 08/13/2026 10:30 AM PDT Description: OpenSearch SQL plugin is a plugin that enables SQL and PPL query capabilities on OpenSearch clusters, including direct query integration with external data sources via Apache Spark. An issue exists where the Flint extension query handler validates SQL queries without sufficient restrictions, allowing a user with async query access to bypass the SQL grammar deny list via the direct query endpoint. Affected Products & Versions: OpenSearch SQL Plugin (open-source, self-managed): - Affected: v2.13 to v3.6 - Fixed: versions 3.7 and 2.19.6 Amazon OpenSearch Service (AWS Managed): - Affected: v2.13 to v3.5 - Fixed: v2.13 to v3.5 (via service software update) Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

CSIRTS triage

vendor: OpenSearch product: OpenSearch SQL Plugin Authentication bypassaffected: v2.13 to v3.6 (open-source); v2.13 to v3.5 (AWS managed)

What: SQL grammar deny list validation bypass in Flint extension query handler allowing users with async query access to bypass SQL restrictions.
Who is affected: OpenSearch SQL Plugin versions 2.13–3.6 self-managed, and AWS OpenSearch Service versions 2.13–3.5.
Urgency: High; authentication bypass allows unprivileged users to execute restricted queries.
Action: Upgrade to OpenSearch SQL Plugin v3.7 or v2.19.6, or apply AWS service software update for managed deployments.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch OpenSearch SQL Plugin

Get an email when a new OpenSearch SQL Plugin advisory drops — max one per day, one-click unsubscribe.

Details

Source: AWS Security Bulletins (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-08-20
Exploitation: Not in CISA KEV at last sync

Original advisory: https://aws.amazon.com/security/security-bulletins/rss/2026-081-aws/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-184280.69% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 50% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-18428	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

highCVE-2026-18428: A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugi…nvd

Recent advisories for - OpenSearch SQL

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-38468: A SQL injection vulnerability in the country-code lookup endpoint in GazellePW (GazellePosterW…nvd · 2026-08-25
unknownCVE-2026-38467: A SQL injection vulnerability in the tags manager in GazellePW (GazellePosterWall) commit 86c4…nvd · 2026-08-25
mediumCVE-2026-78468: The FluentCRM Pro – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Le…nvd · 2026-08-25
highCVE-2026-75498: Webkul QloApps does not validate request parameters before a database query. A remote, authent…nvd · 2026-08-25
highCVE-2026-75497: Webkul QloApps does not validate request parameters before a database query. A remote, authent…nvd · 2026-08-25
mediumCVE-2026-77824: The Media Sweep – WordPress Media Cleaner plugin for WordPress is vulnerable to generic SQL In…nvd · 2026-08-25