CLEANSTART-2026-IN61890: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite Avatica
Security vulnerability affects the wso2am package. Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite Avatica.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/wso2amto a version that resolves this vulnerability.Fixed in 4.7.0-r5
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates the issue is exploitable over the network with low privileges. It does not require user interaction.
What security impact could successful exploitation have?
The reported CVSS vector assigns high impact to confidentiality, integrity, and availability. The vulnerability is rated high severity with a score of 8.8.
What should be checked when determining exposure?
Review deployments using the cleanstart/wso2am software package. The available data identifies that package as affected but does not provide affected or fixed version information.