CVE-2026-18428
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint.
Risk Assessment
An authenticated attacker can execute arbitrary code on Apache Spark workers, potentially leading to full system compromise, data theft, or service disruption.
Recommendation
Upgrade the OpenSearch SQL plugin to a version containing the fix and restrict async query access to trusted users only.
Original NVD description (English source)
A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint.