OpenSearch SQL Plugin: Critical Deserialization Flaw Lets Attackers Execute Code

OpenSearch SQL Plugin has a nasty vulnerability (CVE-2026-83497) that lets authenticated users with basic read permissions run arbitrary code via a crafted cursor parameter. If you're running v2.8–v3.6 (self-managed) or v2.9–v3.5 (AWS managed), you need to patch immediately. Update to v3.7, v2.19.6, or apply the AWS service software update to stay safe.