CVE-2026-119084 Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection Parameters

CriticalCVSS 9.2 EPSS 0.45%

Published: 2026-11-03 23:05
Updated: 2026-11-06 22:17
Exploit status: No public exploit known

Description

Unsafe reflection in the connection parameter and credentials profile handling of Amazon Redshift JDBC Driver before 2.3.0 might allow an actor who can influence the JDBC connection URL or the AWS credentials profile to execute arbitrary code in the application context, provided a suitable class is available on the application classpath.

To remediate this issue, users should upgrade to version 2.3.0 or later.

Affected products

Product	Affected versions	Fixed in
AWS amazon-redshift-jdbc-driver	< 2.3.0	2.3.0

References

github.com patch release-notes
aws.amazon.com vendor-advisory
github.com third-party-advisory

CVSS v4.0

9.2 Critical

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: Present
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: High
Subsequent System Confidentiality: None
Subsequent System Integrity: None
Subsequent System Availability: None

All scores (4)

v4.0 9.2 · amzn
v4.0 9.2 · ff89ba41-3aa1-4d27-914a-91399e9639e5
v3.1 8.1 · amzn
v3.1 8.1 · ff89ba41-3aa1-4d27-914a-91399e9639e5

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.45% (percentile 39.2)
CWE: CWE-470 Use of Externally-Controlled input to select classes or code ('unsafe reflection')

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.