The vulnerability allows unsafe deserialization of a cursor parameter in the OpenSearch SQL plugin, which can lead to arbitrary code execution on the server. An attacker with basic read/search permissions can craft a request to the plugins/sql endpoint that triggers the deserialization flaw, enabling them to run arbitrary code with the privileges of the OpenSearch service. This is a high‑impact weakness classified as CWE‑502.

The affected product is the OpenSearch SQL plugin, advertised as opensearch-project:sql. Versions in the 2.x line from 2.8.0.0 up to but not including 2.19.6.0, and the 3.x line prior to 3.7.0.0 are vulnerable. The fix is included in releases 2.19.6.0 and 3.7.0.0.

The CVSS score of 8.7 indicates a high severity vulnerability. The EPSS score is not available, but the lack of a KEV listing suggests no publicly known exploitation yet. The likely attack vector is a remote authenticated user submitting a crafted cursor value via the plugins/sql endpoint. If exploited, it could compromise the entire OpenSearch cluster by executing arbitrary code on the host.