Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.2

Amazon Redshift JDBC driver could run attacker code

CVE-2026-119084 · published 1 day ago
Summary

The Redshift JDBC driver versions before 2.3.0 let a malicious user who can change the connection string or AWS credentials profile cause the application to load and run any class that is already on its classpath. This could let the attacker execute their own code inside your program. Upgrade the driver to version 2.3.0 or newer to close the risk.

Original advisory text
Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection Parameters
Unsafe reflection in the connection parameter and credentials profile handling of Amazon Redshift JDBC Driver before 2.3.0 might allow an actor who can influence the JDBC connection URL or the AWS credentials profile to execute arbitrary code in the application context, provided a suitable class is available on the application classpath.



To remediate this issue, users should upgrade to version 2.3.0 or later.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.2 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Timeline
Published3 Nov 2026
Updated4 Nov 2026
First seen3 Nov 2026
Sources
CVE-2026-119084 · NVD
CVE-2026-119084 · OSV
GHSA-qrph-v96m-w2mv · GHSA
Track software like this
Free during beta