01 Record

CVE-2026-18428

SQL Query Validation Bypass in OpenSearch Direct Query

HighPUBLISHEDCNA: AMZN

Base score8.7 CVSS v4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

02 Description

SQL Query Validation Bypass in OpenSearch Direct Query

Published: 2026-08-13 17:32Z1 DAY AGO
Last updated: 2026-08-13 17:57Z1 DAY AGO
Reserved: 2026-07-30
Assigning CNA: AMZN
Record state: PUBLISHED
Severity: High (CVSS 8.7)
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses: CWE-693
SSVC decision: ExploitationnoneAutomatablenoTechnical Impacttotal
Data version: 5.2
Document digest: f3252dcec17667e28b14a5b62b7d7cb863c3031a1e3326c0e9755c56f4923912

VendorProductVersionsPlatforms

AWSOpensearch2.13 to 3.5—

GithubOpensearch2.13 to 3.6—