CVE-2026-63393

{
  "etk_id": "ETK-2026-3136",
  "cve_id": "CVE-2026-63393",
  "display_id": "CVE-2026-63393",
  "ghsa_id": "GHSA-r8cv-xvqm-4qj4",
  "euvd_id": "EUVD-2026-114543",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unsafe deserialization in OpenSearch SQL",
  "summary": "OpenSearch SQL versions 2.8.0.0 through versions before 2.19.6.0, and 3.x versions before 3.7.0.0, are affected. An authenticated remote user with basic read or search permissions may execute code on the server by sending malicious serialized input to the SQL service.",
  "mitigation": "Upgrade OpenSearch SQL to 2.19.6.0 or 3.7.0.0, as appropriate for your release line. Until upgraded, restrict SQL endpoint access and limit read/search privileges to trusted users.",
  "vendor": "opensearch-project",
  "product": "sql",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 2.19.6",
        ">= 3.0.0 < 3.7.0"
      ],
      "ecosystem": "maven",
      "fixed_versions": [
        "2.19.6",
        "3.7.0"
      ],
      "package_name": null,
      "purl": null
    }
  ],
  "cwes": [
    502
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 17.026061266666666,
  "t0_at": "2026-10-30T22:22:05.735000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-30T22:22:05.735000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-30T22:22:05.735000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63393"
    }
  }
}