A critical remote code execution vulnerability exists in the OpenSearch SQL plugin, allowing authenticated users to execute arbitrary code on the underlying host.

This vulnerability involves the insecure deserialization of untrusted data within the cursor pagination component of the SQL plugin. An attacker with basic read or search permissions can trigger this by submitting a malicious cursor parameter to the plugins/sql endpoint.

The ability to execute arbitrary code on the server represents a total compromise of the affected node. This vulnerability, carrying a CVSS score of 8.8, poses a significant risk of data exfiltration, lateral movement within the network, and complete loss of system integrity. Organizations relying on OpenSearch for critical data processing must prioritize this update to prevent unauthorized administrative control.

Immediate Action: Update OpenSearch to version 3.7.0 or 2.19.6, or apply the specific patches provided in the Amazon OpenSearch Service security bulletin.

Proactive Monitoring: Inspect server access logs for unusual requests directed at the plugins/sql endpoint and monitor system processes for unauthorized child process spawning.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter or block requests containing suspicious or malformed serialized objects within the cursor parameter.

Public Exploit Available: False

Given the high CVSS score and the severity of remote code execution, this vulnerability should be treated as a high-priority remediation task. Administrators must verify their current version against the affected list and apply the latest security patches immediately to eliminate the deserialization vector.