CVE-2026-18428

The EPSS-CVSS gap in CVE-2026-18428 deserves scrutiny, but not for the reason many assume. The CVSS 8.8 reflects genuine severity—arbitrary code execution on Spark workers is not a bounded event but a potential pivot point inside data pipelines. The low EPSS score (0.00689) likely reflects the vulnerability's newness and specialized nature, not actual exploit rarity. These scores consistently lag behind for authenticated-component CVEs in extensions, because commodity threat feeds don't have coverage for novel attack surfaces until exploitation is already observed. The authentication requirement is real but overstated as a protective factor. Async query access gets provisioned broadly for developer convenience—it's exactly the permission that gets granted when debugging workflow failures, and organizations without mature least-privilege discipline will have substantial populations of nominally-authenticated users with this capability. The flint extension specifically compounds this: it's a specialized query handler often maintained by smaller teams, audited less frequently, and may ship active by default in standard OpenSearch installations. Most security reviews examine the SQL plugin surface, not the flint extension handler—and that's where this bypass lives. What makes this distinctive is the data access dimension. Spark workers process, transform, and route data between storage systems. Compromising one doesn't just mean code execution—it means positioning inside the query optimizer's decision logic about what data to fetch and where to send results. The exfiltration opportunity is targeted, not opportunistic. Verify whether the flint extension is running in your OpenSearch deployment—don't assume it's absent. If async query access exists, treat the unpatched cluster as a widening exposure window: every new user provisioned while this CVE persists is additional systemic debt. The low EPSS is a statement about current observation, not about the consequence severity or the rate at which the exploitable population grows.

Reviewed through automated stages and approved by a human before publication.