Security Feed
See the latest insights and analysis from our MDR team.
RSS for SlackCVE-2026-18428
By Yogev Levi |
17 August 2026
OpenSearch SQL plugin async direct query handler allows SQL denylist bypass
OpenSearch SQL Plugin Flint extension async query handler validates SQL with insufficient restrictions, letting users with async query access bypass the SQL grammar deny list via the direct query endpoint. Affects open-source v2.13-v3.6 (fixed 3.7 and 2.19.6). Amazon OpenSearch Service v2.13-v3.5 is fixed via service software update