CVE details
CVE-2026-83497
Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search permissions to execute arbitrary code on the server by sending a crafted cursor parameter to the plugins/sql endpoint.
Matched ports (4)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| textproc/opensearch210 | opensearch210 | 2.10.0_5 | unaddressed | opensearch@FreeBSD.org |
| textproc/opensearch213 | opensearch213 | 2.13.0_4 | unaddressed | opensearch@FreeBSD.org |
| textproc/opensearch216 | opensearch216 | 2.16.0_3 | unaddressed | opensearch@FreeBSD.org |
| textproc/opensearch219 | opensearch219 | 2.19.6 | unaddressed | opensearch@FreeBSD.org |
Template for a VuXML entry
Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>FIXME -- FIXME</topic>
<affects>
<package>
<name>opensearch210</name>
<range><lt>FIXME</lt></range>
</package>
<package>
<name>opensearch213</name>
<range><lt>FIXME</lt></range>
</package>
<package>
<name>opensearch216</name>
<range><lt>FIXME</lt></range>
</package>
<package>
<name>opensearch219</name>
<range><lt>FIXME</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Unrestricted deserialization of untrusted data in the cursor
pagination component in the OpenSearch SQL plugin allows a remote
authenticated user with basic read/search permissions to execute
arbitrary code on the server by sending a crafted cursor parameter to
the plugins/sql endpoint.</p>
</body>
</description>
<references>
<cvename>CVE-2026-83497</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2026-83497</url>
</references>
<dates>
<discovery>2026-08-31</discovery>
<entry>2026-10-26</entry>
</dates>
</vuln>