CVE-2026-119084: Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection Parameters
Unsafe reflection in the connection parameter and credentials profile handling of Amazon Redshift JDBC Driver before 2.3.0 might allow an actor who can influence the JDBC connection URL or the AWS credentials profile to execute arbitrary code in the application context, provided a suitable class is available on the application classpath.
To remediate this issue, users should upgrade to version 2.3.0 or later.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Amazon Redshift JDBC Driverto a version that resolves this vulnerability.Fixed in 2.3.0
Event History
Frequently Asked Questions
Which applications are exposed to exploitation?
Applications using an Amazon Redshift JDBC Driver version before 2.3.0 are exposed if an attacker can influence the JDBC connection URL or AWS credentials profile and a suitable class is present on the application's classpath.
Does exploitation require authentication or user interaction?
The supplied vector indicates no privileges and no user interaction are required. However, exploitation depends on the attacker being able to influence connection parameters or the credentials profile, and on a suitable class being available on the classpath.
What is the recommended remediation?
Upgrade the Amazon Redshift JDBC Driver to version 2.3.0 or later.