Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver
Priority MEDIUM 43CWE-470Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under certain conditions, the driver could load and execute arbitrary classes when processing JDBC connection URL parameters. An actor who can influence the connection URL could potentially execute code in the application context, provided a suitable class is available on the application's classpath. To mitigate this issue, users should upgrade to version 2.2.2 or later.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00597 48th percentileScored 2026-11-07
Fix Fixed Amazon Redshift JDBC Driver (Amazon): 2.2.2com.amazon.redshift:redshift-jdbc42 (Maven): 2.2.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| AWS | Amazon Redshift JDBC Driver | before 2.2.2 | 2.2.2 | Patch available | CNA |
| — | com.amazon.redshift:redshift-jdbc42 (Maven) | before 2.2.2 | 2.2.2 | Patch available | GHSA-wmmv-vvg5-993q |
- Amazon Redshift JDBC Driver VendorAWS Affected before 2.2.2 Fixed in 2.2.2 Patch available CNA
- com.amazon.redshift:redshift-jdbc42 (Maven) Vendor— Affected before 2.2.2 Fixed in 2.2.2 Patch available GHSA-wmmv-vvg5-993q
Remediation
- Fix · CNA Amazon Redshift JDBC Driver (Amazon) Fixed in 2.2.2
- Fix · GHSA-wmmv-vvg5-993q com.amazon.redshift:redshift-jdbc42 (Maven) Fixed in 2.2.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-8178
- 2026-10-03 Alias added: GHSA-wmmv-vvg5-993q
- 2026-10-20 Affected versions changed · CNA
- 2026-10-25 EPSS moved to the below the 50th percentile
References
Advisory 3
More AWS vulnerabilities
- TI-2026-23989 crypto: algif_aead - Revert to operating out-of-place KEVCVSS 3.1HIGH 7.8
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2024-18648 Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM… CVSS 3.1CRITICAL 9.8
- TI-2024-05929 Openssh: regresshion - race condition in ssh allows rce/dos CVSS 3.1HIGH 8.1
- TI-2025-03847 Input validation issue in AWS Amplify Studio UI component properties CVSS 4.0CRITICAL 9.0
- TI-2026-11603 HTTP/2 Stream Parser Confusion Body-Inspection Bypass in Amazon CloudFront with AWS WAF CVSS 4.0HIGH 7.9
Sources
- CVE-2026-8178 · CVE Program
- CVE-2026-8178 · NVD
- FIRST EPSS
- GHSA-wmmv-vvg5-993q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences