CVE-2026-18061: Improper Restriction of XML External Entity References in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin
Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results, including stored database and IAM role credentials, via crafted XML data in a cached column value.
To remediate this issue, users should upgrade to version 4.3.0 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AWS Advanced JDBC Wrapper RemoteQueryCachePluginto a version that resolves this vulnerability.Fixed in 4.3.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper versions 3.3.0 through 4.2.0 are exposed if an actor can write to the shared cache infrastructure and application hosts read cached query results.
What access does an attacker need?
The attacker needs write access to the shared cache infrastructure in order to place crafted XML data in a cached column value. No user interaction is required.
What could be disclosed?
Crafted cached XML may cause application hosts to disclose sensitive local files, including stored database credentials and IAM role credentials.
How should this be remediated?
Upgrade AWS Advanced JDBC Wrapper to version 4.3.0 or later.